chore(deps): Update GitHub Actions - #51
Conversation
WalkthroughRepository GitHub Actions workflows update pinned action and reusable workflow references. Runner hardening, checkout, uv, Python, CodeQL, provenance, and shared workflows use newer revisions. Job logic and configuration remain unchanged. ChangesCI dependency pin updates
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related issues
Possibly related PRs
Suggested labels: Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR updates the pinned commit SHA references for several org-level reusable GitHub Actions workflows (ByronWilliamsCPA/.github) from 987d517… to 7198a49…, keeping CI/security automation aligned with the latest patch-level fixes.
Changes:
- Bumped the referenced digest for the shared
python-*reusable workflows across CI-adjacent pipelines (SonarCloud, SLSA provenance, SBOM, coverage uploads, docs, compatibility, etc.). - No workflow logic or inputs were changed in this repo—only the pinned workflow revision.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/sonarcloud.yml | Update reusable workflow pin for SonarCloud analysis. |
| .github/workflows/slsa-provenance.yml | Update reusable workflow pin for SLSA provenance generation. |
| .github/workflows/sbom.yml | Update reusable workflow pin for SBOM generation/security scan. |
| .github/workflows/qlty.yml | Update reusable workflow pin for Qlty coverage upload. |
| .github/workflows/python-compatibility.yml | Update reusable workflow pin for compatibility matrix runs. |
| .github/workflows/pr-validation.yml | Update reusable workflow pin for supplemental PR checks. |
| .github/workflows/mutation-testing.yml | Update reusable workflow pin for mutation testing. |
| .github/workflows/fips-compatibility.yml | Update reusable workflow pin for FIPS compatibility checks. |
| .github/workflows/docs.yml | Update reusable workflow pin for docs build/deploy. |
| .github/workflows/coverage.yml | Update reusable workflow pin for Qlty coverage upload (post-CI). |
| .github/workflows/codecov.yml | Update reusable workflow pin for Codecov coverage upload. |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
a285c62 to
4fcf889
Compare
williaby
changed the title
4fcf889 to
526af99
Compare
williaby
changed the title
526af99 to
d5cf124
Compare
williaby
changed the title
d5cf124 to
f86ae6a
Compare
williaby
changed the title
f86ae6a to
3163077
Compare
williaby
changed the title
3163077 to
f2b59df
Compare
williaby
changed the title
f2b59df to
b30d141
Compare
williaby
changed the title
b30d141 to
e047f62
Compare
williaby
changed the title
e047f62 to
b5877f0
Compare
williaby
changed the title
b5877f0 to
4489e10
Compare
williaby
changed the title
4489e10 to
a1db00f
Compare
8acdc91 to
658caaa
Compare
89baea0 to
ad5a69f
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 50-51: Disable persisted checkout credentials by adding
persist-credentials: false to every actions/checkout step in
.github/workflows/ci.yml at lines 50-51, 86-87, 141-142, and 192-193; update all
four sites consistently.
In @.github/workflows/pr-validation.yml:
- Around line 63-64: Add persist-credentials: false to the actions/checkout
steps in .github/workflows/pr-validation.yml lines 63-64,
.github/workflows/publish-artifact-registry.yml lines 69-70, and
.github/workflows/security-analysis.yml lines 42-43; no other checkout behavior
needs to change.
- Line 32: Update the reusable workflow invocation using the
python-supplemental-checks workflow reference to remove secrets: inherit when no
secrets are required, or replace it with an explicit secrets mapping containing
only the names consumed by that workflow; preserve the existing workflow call
and use minimal secret exposure.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 03d05bf7-dccc-4770-acec-3e67de8323e3
📒 Files selected for processing (18)
.github/workflows/ci.yml.github/workflows/codecov.yml.github/workflows/codeql.yml.github/workflows/coverage.yml.github/workflows/dependency-review.yml.github/workflows/docs.yml.github/workflows/fips-compatibility.yml.github/workflows/mutation-testing.yml.github/workflows/pr-validation.yml.github/workflows/publish-artifact-registry.yml.github/workflows/python-compatibility.yml.github/workflows/qlty.yml.github/workflows/release.yml.github/workflows/reuse.yml.github/workflows/sbom.yml.github/workflows/security-analysis.yml.github/workflows/slsa-provenance.yml.github/workflows/sonarcloud.yml
| - name: Checkout repository | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Disable persisted checkout credentials in all four CI jobs.
actions/checkout writes the workflow token into .git/config, exposing it to later repository-controlled commands. Add persist-credentials: false at every affected site:
.github/workflows/ci.yml#L50-L51: addpersist-credentials: false..github/workflows/ci.yml#L86-L87: addpersist-credentials: false..github/workflows/ci.yml#L141-L142: addpersist-credentials: false..github/workflows/ci.yml#L192-L193: addpersist-credentials: false.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 50-51: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 1 file
.github/workflows/ci.yml#L50-L51(this comment).github/workflows/ci.yml#L86-L87.github/workflows/ci.yml#L141-L142.github/workflows/ci.yml#L192-L193
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 50 - 51, Disable persisted checkout
credentials by adding persist-credentials: false to every actions/checkout step
in .github/workflows/ci.yml at lines 50-51, 86-87, 141-142, and 192-193; update
all four sites consistently.
Sources: Path instructions, Linters/SAST tools
| # ========================================================================== | ||
| supplemental-checks: | ||
| uses: ByronWilliamsCPA/.github/.github/workflows/python-supplemental-checks.yml@987d517d3c8e4b180f4dd15de6d9575f0df91182 # main | ||
| uses: ByronWilliamsCPA/.github/.github/workflows/python-supplemental-checks.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Pass only the secrets required by the reusable workflow.
secrets: inherit at Line 49 exposes every caller secret to this reusable workflow. Remove it if no secret is needed, or map only the specific required secret names.
As per path instructions, workflows must use proper secret handling and minimal permissions.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 32-32: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-validation.yml at line 32, Update the reusable workflow
invocation using the python-supplemental-checks workflow reference to remove
secrets: inherit when no secrets are required, or replace it with an explicit
secrets mapping containing only the names consumed by that workflow; preserve
the existing workflow call and use minimal secret exposure.
Sources: Path instructions, Linters/SAST tools
| - name: Checkout repository | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Prevent unnecessary checkout-token exposure across read-only jobs.
These jobs retain GITHUB_TOKEN in Git configuration even though they do not need Git authentication after checkout.
.github/workflows/pr-validation.yml#L63-L64: addpersist-credentials: false..github/workflows/publish-artifact-registry.yml#L69-L70: addpersist-credentials: false..github/workflows/security-analysis.yml#L42-L43: addpersist-credentials: false.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 63-64: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 3 files
.github/workflows/pr-validation.yml#L63-L64(this comment).github/workflows/publish-artifact-registry.yml#L69-L70.github/workflows/security-analysis.yml#L42-L43
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-validation.yml around lines 63 - 64, Add
persist-credentials: false to the actions/checkout steps in
.github/workflows/pr-validation.yml lines 63-64,
.github/workflows/publish-artifact-registry.yml lines 69-70, and
.github/workflows/security-analysis.yml lines 42-43; no other checkout behavior
needs to change.
Sources: Path instructions, Linters/SAST tools
|
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/mutation-testing.yml:
- Line 42: Update the reusable workflow invocation in the mutation-testing
workflow to remove secrets: inherit unless python-mutation.yml requires a
secret; if it does, pass only the specific required secret explicitly.
In @.github/workflows/release.yml:
- Around line 53-56: Disable persisted checkout credentials at all three
read-only checkout sites: add persist-credentials: false in
.github/workflows/release.yml lines 53-56 and
.github/workflows/slsa-provenance.yml lines 50-53 alongside the existing
checkout options, and add a with block containing it in
.github/workflows/reuse.yml lines 37-38.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 2bf20245-a4f7-4acf-b1e1-dfb5db81091d
📒 Files selected for processing (18)
.github/workflows/ci.yml.github/workflows/codecov.yml.github/workflows/codeql.yml.github/workflows/coverage.yml.github/workflows/dependency-review.yml.github/workflows/docs.yml.github/workflows/fips-compatibility.yml.github/workflows/mutation-testing.yml.github/workflows/pr-validation.yml.github/workflows/publish-artifact-registry.yml.github/workflows/python-compatibility.yml.github/workflows/qlty.yml.github/workflows/release.yml.github/workflows/reuse.yml.github/workflows/sbom.yml.github/workflows/security-analysis.yml.github/workflows/slsa-provenance.yml.github/workflows/sonarcloud.yml
| mutation: | ||
| name: Mutation Testing | ||
| uses: ByronWilliamsCPA/.github/.github/workflows/python-mutation.yml@987d517d3c8e4b180f4dd15de6d9575f0df91182 # main | ||
| uses: ByronWilliamsCPA/.github/.github/workflows/python-mutation.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow snippet =="
if [ -f .github/workflows/mutation-testing.yml ]; then
nl -ba .github/workflows/mutation-testing.yml | sed -n '1,120p'
else
echo "missing .github/workflows/mutation-testing.yml"
fi
echo
echo "== referenced reusable workflow references in repo =="
rg -n "python-mutation|mutation-testing|secrets:\s*inherit|secrets:" .github/workflows 2>/dev/null || true
echo
echo "== external repo commit/branch info =="
OWNER="ByronWilliamsCPA"
REPO=".github"
SHA="7d12f5486ab5c856397ebaa4acd3c99ca385227c"
BRANCH="main"
if command -v gh >/dev/null 2>&1; then
echo "-- ref head --"
gh api "repos/${OWNER}/${REPO}/git/ref/${BRANCH//\//%2F}" --jq '.object.sha'
echo "-- tag/object info (if exists) --"
gh api "repos/${OWNER}/${REPO}/git/refs/tags/$SHA" --bare 2>/dev/null || true
echo "-- sha existence --"
gh api "repos/${OWNER}/${REPO}/commits/$SHA" --jq '{sha:.sha, message:.commit.message}'
echo "-- file existence/content HEAD --"
FILE="python-mutation.yml"
gh api "repos/${OWNER}/${REPO}/contents/${FILE}?ref=$BRANCH" --jq '{path:.path, sha:.sha}' || true
gh api "repos/${OWNER}/${REPO}/contents/${FILE}?ref=$BRANCH" --jq '.content | `@base64d`' || true
echo "-- file existence/content commit --"
gh api "repos/${OWNER}/${REPO}/contents/${FILE}?ref=$SHA" --jq '{path:.path, sha:.sha}' || true
gh api "repos/${OWNER}/${REPO}/contents/${FILE}?ref=$SHA" --jq '.content | `@base64d`' || true
else
echo "gh unavailable"
fiRepository: ByronWilliamsCPA/python-libs
Length of output: 229
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow snippet =="
if [ -f .github/workflows/mutation-testing.yml ]; then
awk '{printf "%6d\t%s\n", NR, $0}' .github/workflows/mutation-testing.yml | head -n 140
else
echo "missing .github/workflows/mutation-testing.yml"
fi
echo
echo "== referenced reusable workflow references in repo =="
grep -RInE "python-mutation|mutation-testing|secrets:\s*inherit|secrets:" .github/workflows 2>/dev/null || true
echo
echo "== external repo file existence/content =="
OWNER="ByronWilliamsCPA"
REPO=".github"
SHA="7d12f5486ab5c856397ebaa4acd3c99ca385227c"
BRANCH="main"
FILE="python-mutation.yml"
python3 - <<'PY' "$OWNER" "$REPO" "$SHA" "$BRANCH" "$FILE"
import json, sys, urllib.request
owner, repo, sha, branch, file = sys.argv[1:6]
base = f"https://api.github.com/repos/{owner}/{repo}"
for ref in [branch, sha]:
url = f"{base}/contents/{file}?ref={ref}"
headers = {"User-Agent": "coderabbit-verification", "Accept": "application/vnd.github+json"}
req = urllib.request.Request(url, headers=headers)
try:
with urllib.request.urlopen(req, timeout=20) as r:
data = json.load(r)
print(f"--- ref {ref} exists: {data.get('path')}, sha: {data.get('sha')}")
import base64
try:
decoded = base64.b64decode(data.get("content", "")).decode("utf-8")
for i,line in enumerate(decoded.splitlines(), 1):
print(f"{i:04d}\t{line}")
except Exception as e:
print("decode error:", e)
except urllib.error.HTTPError as e:
print(f"--- ref {ref} absent/error: {e.code} {e.reason}")
PY
echo
echo "== pyyaml secrets extraction =="
python3 - <<'PY'
try:
import urllib3
import yaml
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
client = urllib3.PoolManager()
url = "https://raw.githubusercontent.com/ByronWilliamsCPA/.github/7d12f5486ab5c856397ebaa4acd3c99ca385227c/python-mutation.yml"
data = client.request("GET", url).data.decode("utf-8")
parsed = yaml.safe_load(data)
print("top-level:", list(parsed.get("joins", [])))
for join in parsed.get("joins", []):
print("join:", join.get("id"), "uses:", join.get("uses"), "requires:", join.get("requires"), "secrets:", join.get("secrets"))
except Exception as e:
print("yaml inspection error:", repr(e))
PYRepository: ByronWilliamsCPA/python-libs
Length of output: 5361
🌐 Web query:
GitHub Actions reusable workflows secrets inherit inherited secrets passed to child workflow
💡 Result:
In GitHub Actions, the secrets: inherit keyword is a convenient way to pass all secrets available to the calling workflow to a reusable workflow [1][2]. When you use secrets: inherit in a job that calls a reusable workflow, all repository, organization, and environment secrets accessible to the calling workflow are automatically made available to the reusable workflow [1][3]. Key behaviors and requirements regarding secrets: inherit include: Scope: The inherited secrets are available to the directly called reusable workflow [1][4]. If your workflow execution involves a chain of calls (e.g., Workflow A calls Workflow B, which calls Workflow C), secrets are only passed to the directly called workflow [1][3]. For Workflow C to receive secrets, they must be explicitly passed or inherited from Workflow B [3]. Definition: When using secrets: inherit, you are not required to explicitly define the secrets in the on section of the reusable workflow to use them [1][4]. However, defining them remains a best practice for clarity and documentation [1]. Security and Usage: Because secrets: inherit shares all accessible secrets, it is generally recommended for use with trusted workflows within the same organization or enterprise [1][4]. For third-party or untrusted reusable workflows, it is safer to pass only the specific secrets required by the workflow individually [5]. Example configuration in the caller workflow: jobs: call-reusable-workflow: uses: octo-org/example-repo/.github/workflows/reusable-workflow.yml@main secrets: inherit
Citations:
- 1: https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows
- 2: https://github.blog/changelog/2022-05-03-github-actions-simplify-using-secrets-with-reusable-workflows/
- 3: https://github.com/github/docs/blob/main/content/actions/how-tos/reuse-automations/reuse-workflows.md
- 4: https://docs.github.com/en/enterprise-cloud@latest/actions/how-tos/reuse-automations/reuse-workflows
- 5: https://stackoverflow.com/questions/78446488/passing-secrets-to-reusable-worflow
🌐 Web query:
ByronWilliamsCPA .github python-mutation.yml line 1-200
💡 Result:
The file python-mutation.yml mentioned in the ByronWilliamsCPA GitHub organization is a reusable GitHub Actions workflow used for mutation testing [1]. It is designed to validate the effectiveness of a project's test suite by introducing code mutations (using mutmut) and checking if the tests detect them [1][2]. Projects within the ByronWilliamsCPA organization (such as fragrance-rater) typically invoke this workflow as an org-level reusable workflow [2][3]. The workflow is generally called with parameters like python-version, source-directory, test-directory, and mutation-threshold [2]. Because this file exists within the.github repository as a template for other projects to call, it does not typically contain project-specific logic in its first 200 lines, but rather defines the reusable CI structure [1][2]. To view the specific contents of the file, you can access the ByronWilliamsCPA/.github repository directly at https://github.com/ByronWilliamsCPA/.github [1].
Citations:
- 1: https://github.com/ByronWilliamsCPA/.github
- 2: https://github.com/ByronWilliamsCPA/fragrance-rater/blob/db2071c857768bb366fc2a4603d9949401aaeb5e/.github/workflows/mutation-testing.yml
- 3: https://github.com/ByronWilliamsCPA/fragrance-rater/blob/27a208124bc4fb80d610419ebc244454f1e1fca4/.github/workflows/mutation-testing.yml
🌐 Web query:
ByronWilliamsCPA .github python-mutation.yml secrets inherit mutated_code_mutations github_token
💡 Result:
The reference to python-mutation.yml within the ByronWilliamsCPA/.github organization repository refers to a centralized, reusable GitHub Actions workflow designed for mutation testing, typically using the mutmut library [1][2][3]. In various caller workflows (such as those found in ByronWilliamsCPA/fragrance-rater), this reusable workflow is invoked as follows [2][3][4]: uses: ByronWilliamsCPA/.github/.github/workflows/python-mutation.yml@<version_sha> secrets: inherit The inclusion of secrets: inherit allows the caller workflow to pass all of its available secrets to the reusable python-mutation.yml workflow [5]. Security Context: While secrets: inherit is a convenient way to pass credentials, it is widely considered a security anti-pattern in GitHub Actions [6][7][8]. By using inherit, the reusable workflow—which may be maintained by another team or reside in a different repository—gains access to every secret defined in the caller's repository [5]. This violates the principle of least privilege, as it widens the "blast radius" should the reusable workflow be compromised [7][5]. Modern security tools (such as Semgrep, OpenRewrite, and specialized ESLint plugins) often flag this practice as a high-severity risk and recommend explicitly passing only the specific secrets required by the called workflow [6][7][5][8].
Citations:
- 1: https://github.com/ByronWilliamsCPA/.github
- 2: https://github.com/ByronWilliamsCPA/fragrance-rater/blob/db2071c857768bb366fc2a4603d9949401aaeb5e/.github/workflows/mutation-testing.yml
- 3: https://github.com/ByronWilliamsCPA/fragrance-rater/blob/35640e4cdd45edb3f19f677b9a031ec5a20d1ee5/.github/workflows/mutation-testing.yml
- 4: https://github.com/ByronWilliamsCPA/fragrance-rater/blob/7822c24f210fe1603a602d794d1bc5b33397cc75/.github/workflows/mutation-testing.yml
- 5: https://actsense.dev/vulnerabilities/secrets_inherit/
- 6: https://docs.openrewrite.org/recipes/github/security/secretsinherit
- 7: Add GitHub Actions
secrets: inheritdetection rule semgrep/semgrep-rules#3803 - 8: https://nick2bad4u.github.io/eslint-plugin-github-actions-2/docs/rules/no-inherit-secrets/
Avoid passing all repository secrets into the reusable workflow.
secrets: inherit exposes every repository/organization secret available to this workflow to python-mutation.yml. Set secrets: inherit only if this reusable workflow actually consumes a secret; otherwise pass only the required secrets explicitly or remove the inheritance.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 42-42: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/mutation-testing.yml at line 42, Update the reusable
workflow invocation in the mutation-testing workflow to remove secrets: inherit
unless python-mutation.yml requires a secret; if it does, pass only the specific
required secret explicitly.
Sources: Path instructions, Linters/SAST tools
| - name: Checkout repository | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 | ||
| with: | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Disable checkout credential persistence in read-only jobs.
These checkout steps do not need Git authentication after checkout. Add persist-credentials: false at each site.
.github/workflows/release.yml#L53-L56: addpersist-credentials: falseto the pre-release test checkout..github/workflows/reuse.yml#L37-L38: add awithblock containingpersist-credentials: false..github/workflows/slsa-provenance.yml#L50-L53: addpersist-credentials: falsebesidefetch-depth: 0.
As per path instructions, workflows must use proper secret handling and minimal permissions.
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 53-56: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 3 files
.github/workflows/release.yml#L53-L56(this comment).github/workflows/reuse.yml#L37-L38.github/workflows/slsa-provenance.yml#L50-L53
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 53 - 56, Disable persisted
checkout credentials at all three read-only checkout sites: add
persist-credentials: false in .github/workflows/release.yml lines 53-56 and
.github/workflows/slsa-provenance.yml lines 50-53 alongside the existing
checkout options, and add a with block containing it in
.github/workflows/reuse.yml lines 37-38.
Sources: Path instructions, Linters/SAST tools
Summary
Why
Scheduled patch update, bug fixes and security patches with no API changes.
Changes
This PR contains the following updates:
987d517→7d12f54v4.1.0→v4.1.1v6.0.3→v6.1.0df4cb1c→d23441av6.2.0→v6.3.0v8.2.0→v8.3.2v4.0.1→v4.0.2v4.36.2→v4.37.4v10.5.3→v10.6.1v2.19.4→v2.20.0Impact
Acceptance Criteria
Testing
Notes
Release Notes
actions/attest-build-provenance (actions/attest-build-provenance)
v4.1.1Compare Source
What's Changed
Full Changelog: actions/attest-build-provenance@v4.1.0...v4.1.1
actions/checkout (actions/checkout)
v6.1.0Compare Source
What's Changed
allow-unsafe-pr-checkoutto v6 by @aiqiaoy in #2500https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
Full Changelog: actions/checkout@v6.0.3...v6.1.0
actions/setup-python (actions/setup-python)
v6.3.0Compare Source
What's Changed
Enhancement
Dependency update
Documentation
New Contributors
Full Changelog: actions/setup-python@v6.2.0...v6.3.0
astral-sh/setup-uv (astral-sh/setup-uv)
v8.3.2: 🌈 update known checksums for 0.11.28Compare Source
Changes
Just a maintenance release
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v8.3.1: 🌈 update known checksums for 0.11.27Compare Source
Changes
Just a maintenance release
🧰 Maintenance
📚 Documentation
v8.3.0: 🌈 Support uv.lock as a version-file sourceCompare Source
Changes
Thanks to @somaz94 you can now use the pinned version of uv itself in
uv.lock. It gets picked up automatically.If you have pinned another version of uv in your
uv.lockyou can use the inputsversionorversion-sourceto override this.🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
dorny/paths-filter (dorny/paths-filter)
v4.0.2Compare Source
github/codeql-action (github/codeql-action)
v4.37.4Compare Source
toolsinput for thecodeql-action/initstep to be specified using agithub-codeql-toolsrepository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value totoolcacheto always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided fortoolsin the workflow definition always takes precedence unless the value of the repository property starts with!. #4037v4.37.3Compare Source
No user facing changes.
v4.37.2Compare Source
config-fileinput that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, theremote=prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023v4.37.1Compare Source
v4.37.0Compare Source
config-fileinput for thecodeql-action/initstep will soon support a new[owner/]repo[@​ref][:path]format. All components except the repository name are optional. If omitted,ownerdefaults to the same owner as the repository the analysis is running for,reftomain, andpathto.github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973v4.36.3Compare Source
No user facing changes.
python-semantic-release/python-semantic-release (python-semantic-release/python-semantic-release)
v10.6.1Compare Source
====================
🪲 Bug Fixes
changelog: Fix handling of whitespace commit bodies in changelog template filter (
PR#1457,d95e46e)cmd-version: Fix non-styled error msg when strict & no new version, closes
#1423_(
PR#1437,5e8f94c)config: Eliminate
.git/in parent dir warnings for monorepos configured with..,closes
#1418_ (PR#1444,7a1f822)📖 Documentation
CHANGELOG: Add
v9.21.2changelog details for website (a4115cf_)configuration: Document
repo_dirconfig option (PR#1444,7a1f822)⚙️ Build System
deps: Expand
python-gitlabdependency range to includev8.0.0+(PR#1451,a4b9a43)deps: Expand
tomlkitdependency range to includev0.14.0+&v0.15.0+(028d539_)deps: Extend
clickdependency range to includev8.2+(01707ea_).. _#1418: #1418
.. _#1423: #1423
.. _01707ea:
01707ea.. _028d539:
028d539.. _5e8f94c:
5e8f94c.. _7a1f822:
7a1f822.. _a4115cf:
a4115cf.. _a4b9a43:
a4b9a43.. _d95e46e:
d95e46e.. _PR#1437: #1437
.. _PR#1444: #1444
.. _PR#1451: #1451
.. _PR#1457: #1457
.. _changelog-v10.6.0:
v10.6.0Compare Source
====================
✨ Features
cmd-version: Add file replacement variant for
version_variables, closes#1375_(
PR#1391,95ce7ec)parser-emoji: Adds more non-release triggering emojis to the default emoji parser (
PR#1410,2833aa9)🪲 Bug Fixes
cmd-config-generate: Fix config output for Microsoft Windows UTF-8 encoding, closes
#702_(
PR#1400,0343194)cmd-publish: Fix handling of asset uploading errors on publish, closes
#1395_ (PR#1397,81a0f98)github: Fix bubble up errors of asset uploads for GitHub (
PR#1397,81a0f98)hvcs: Mask git credential URL in very verbose debug logs, closes
#1426_ (PR#1445,811afb0)📖 Documentation
cmd-config-generate: Add Windows PowerShell specific
generate-configusage example(
PR#1400,0343194)configuration: Modify
version_variablesdefinition to include new file replacement(
PR#1391,95ce7ec)examples: Update references to github actions for hash references (
PR#1449,873da58)package: Change package changelog link to doc website (
PR#1434,05f897f).. _#1375: #1375
.. _#1395: #1395
.. _#1426: #1426
.. _#702: #702
.. _0343194:
0343194.. _05f897f:
05f897f.. _2833aa9:
2833aa9.. _811afb0:
811afb0.. _81a0f98:
81a0f98.. _873da58:
873da58.. _95ce7ec:
95ce7ec.. _PR#1391: #1391
.. _PR#1397: #1397
.. _PR#1400: #1400
.. _PR#1410: #1410
.. _PR#1434: #1434
.. _PR#1445: #1445
.. _PR#1449: #1449
.. _changelog-v10.5.3:
v10.6Compare Source
====================
🪲 Bug Fixes
changelog: Fix handling of whitespace commit bodies in changelog template filter (
PR#1457,d95e46e)cmd-version: Fix non-styled error msg when strict & no new version, closes
#1423_(
PR#1437,5e8f94c)config: Eliminate
.git/in parent dir warnings for monorepos configured with..,closes
#1418_ (PR#1444,7a1f822)📖 Documentation
CHANGELOG: Add
v9.21.2changelog details for website (a4115cf_)configuration: Document
repo_dirconfig option (PR#1444,7a1f822)⚙️ Build System
deps: Expand
python-gitlabdependency range to includev8.0.0+(PR#1451,a4b9a43)deps: Expand
tomlkitdependency range to includev0.14.0+&v0.15.0+(028d539_)deps: Extend
clickdependency range to includev8.2+(01707ea_).. _#1418: #1418
.. _#1423: #1423
.. _01707ea:
01707ea.. _028d539:
028d539.. _5e8f94c:
5e8f94c.. _7a1f822:
7a1f822.. _a4115cf:
a4115cf.. _a4b9a43:
a4b9a43.. _d95e46e:
d95e46e.. _PR#1437: #1437
.. _PR#1444: #1444
.. _PR#1451: #1451
.. _PR#1457: #1457
.. _changelog-v10.6.0:
step-security/harden-runner (step-security/harden-runner)
v2.20.0Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.19.4...v2.20.0
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.