Skip to content

🚨 Update github actions (main) (major) - #1679

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/main-major-github-actions
Open

🚨 Update github actions (main) (major)#1679
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/main-major-github-actions

Conversation

@renovate

@renovate renovate Bot commented Feb 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending
actions/checkout action major v6.1.0 → v7.0.1
actions/setup-go action major v6.5.0 → v7.0.0
actions/upload-artifact action major v6.0.0 → v7.0.1
codecov/codecov-action action major v5.5.5 → v7.0.0 v7.1.0
softprops/action-gh-release action major v2.6.2 → v3.0.3

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

v7.0.0

Compare Source

actions/setup-go (actions/setup-go)

v7.0.0

Compare Source

What's Changed
New Contributors

Full Changelog: actions/setup-go@v6...v7.0.0

actions/upload-artifact (actions/upload-artifact)

v7.0.1

Compare Source

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

codecov/codecov-action (codecov/codecov-action)

v7.0.0

Compare Source

⚠️ Due to migration issues with keybase, we are unable to update our keys under the codecovsecurity account. We have deleted the account and are using codecovsecops with the original gpg key

What's Changed

Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0

v6.0.2

Compare Source

This is a copy of the v7.0.0 release to make updates easier

What's Changed

Full Changelog: codecov/codecov-action@v6.0.1...v6.0.2

v6.0.1

Compare Source

What's Changed

Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1

v6.0.0

Compare Source

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️
What's Changed

Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0

softprops/action-gh-release (softprops/action-gh-release)

v3.0.3

Compare Source

3.0.3 is a maintenance release with updated dependencies. It also safely
classifies malformed GitHub API errors to avoid secondary failures (#​822).

What's Changed

Bug fixes 🐛
Other Changes 🔄
  • dependency updates

v3.0.2

Compare Source

3.0.2 is a patch release focused on release reliability and compatibility. It
reuses existing draft releases when publishing prereleases, supports replacing
release assets on Gitea, hardens streamed asset uploads, and provides clearer
release-creation diagnostics. It also includes TypeScript, coverage, and tooling
maintenance merged since 3.0.1.

This release fixes #​795, #​438, and #​803. The upload transport hardening covers the
historical failure reported in #​790, although current hosted Node 24 runners did
not reproduce it naturally. The diagnostics work is related to #​786 and does not
claim a reproducible release-creation fix.

What's Changed
Exciting New Features 🎉
Bug fixes 🐛
Other Changes 🔄

v3.0.1

Compare Source

3.0.1

  • maintenance release with updated dependencies

v3.0.0

Compare Source

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24.
Use v3 on GitHub-hosted runners and self-hosted fleets that already support the
Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on
v2.6.2.

What's Changed

Other Changes 🔄
  • Move the action runtime and bundle target to Node 24
  • Update @types/node to the Node 24 line and allow future Dependabot updates
  • Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@codecov

codecov Bot commented Feb 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag Coverage Δ
unit-tests 100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@renovate
renovate Bot force-pushed the renovate/main-major-github-actions branch from e4b43a1 to cf6e91d Compare March 5, 2026 10:13
@renovate renovate Bot changed the title 🚨 Update actions/upload-artifact action to v7 (main) 🚨 Update github actions (main) (major) Mar 26, 2026
@renovate
renovate Bot force-pushed the renovate/main-major-github-actions branch from cf6e91d to 88adc4b Compare March 26, 2026 18:47
@renovate
renovate Bot force-pushed the renovate/main-major-github-actions branch 4 times, most recently from 0f4e8e1 to 8bbcd9b Compare April 15, 2026 12:51
@renovate
renovate Bot force-pushed the renovate/main-major-github-actions branch 3 times, most recently from d434b3b to 7ff12a4 Compare April 23, 2026 14:15
@renovate
renovate Bot force-pushed the renovate/main-major-github-actions branch from 7ff12a4 to d8efd66 Compare April 29, 2026 11:10
@renovate
renovate Bot force-pushed the renovate/main-major-github-actions branch 3 times, most recently from 6aab9ac to d0a72c0 Compare May 19, 2026 00:10
@renovate
renovate Bot force-pushed the renovate/main-major-github-actions branch 2 times, most recently from fc1e847 to bc16505 Compare May 28, 2026 16:20
@renovate
renovate Bot force-pushed the renovate/main-major-github-actions branch from bc16505 to 83d9f86 Compare June 7, 2026 06:12
@fullsend-ai-review

fullsend-ai-review Bot commented Jun 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Review

Findings

Medium

  • [protected-path] .github/workflows/codeql.yml, .github/workflows/pre-merge-ci.yaml, .github/workflows/push-bundles.yaml, .github/workflows/release.yaml, .github/workflows/scorecards.yml — All five modified files fall under the governance-protected path .github/. The PR is a Renovate-generated major version bump of SHA-pinned GitHub Actions (actions/checkout v6.1.0→v7.0.1, actions/setup-go v6.5.0→v7.0.0, codecov/codecov-action v5.5.5→v7.0.0, softprops/action-gh-release v2.6.2→v3.0.3, actions/upload-artifact v6.0.0→v7.0.1) with the repository's renovate.json extending the shared conforma/.github configuration — this provides implicit authorization for the class of change. Human approval is nonetheless always required for protected-path changes regardless of context; a reviewer should confirm each new commit SHA maps to the tagged release before merging. Note: intent-coherence finding cites the mechanical nature of the change as authorization for this update.

Info

  • [scope-authorization-implicit] N/A — Authorization inferred from mechanical nature of change (Renovate-generated major version bumps of SHA-pinned GitHub Actions across workflow files, +11/-11 with no logic changes). No architectural review required.
  • [provenance-warning] N/A — Prior review context discarded: provenance validation failed (PRIOR_REVIEW_PROVENANCE=unverifiable-wrong-app). This review treats all findings as first-time assessments; severity anchoring was skipped for this run.
  • [risk-assessment] N/A — Composite risk score: 2 / 5 (moderate). Rationale: small SHA-pinned Renovate bump of five GitHub Actions across CI workflows with no logic changes; protected-path and major-version bumps warrant moderate rather than low risk.
Previous run

Review

Renovate-generated PR that bumps five GitHub Actions to new major versions with commit-SHA pinning updated. The changes are mechanical value-only edits inside .github/workflows/* and do not modify workflow permissions: blocks, secrets, triggers, or business logic. Sub-agent review (correctness, security, style-conventions, intent-coherence) surfaced no code-level defects.

Human maintainer sign-off is still required because the PR touches a protected governance path (.github/) and carries the requires-manual-review label.

Findings

Medium

  • [protected-path] .github/workflows/ — The PR modifies five workflow files under the protected path .github/: codeql.yml, pre-merge-ci.yaml, push-bundles.yaml, release.yaml, scorecards.yml. The Renovate-generated PR body enumerates each action's upstream release notes and renovate.json (extending github>conforma/.github) authorizes this update pattern, so context for the change is sufficient. Nevertheless, protected-path changes always require human maintainer approval — this finding is a governance notice, not a defect. Remediation: a human reviewer with authority over CI infrastructure must confirm the new pinned SHAs correspond to the intended upstream tags and approve the merge; the requires-manual-review label already flags this expectation.
Previous run (2)

Review

Findings

Medium

  • [protected-path] .github/workflows/codeql.yml, .github/workflows/pre-merge-ci.yaml, .github/workflows/push-bundles.yaml, .github/workflows/release.yaml, .github/workflows/scorecards.yml — This PR modifies files under the .github/ protected path. Human approval is always required for protected-path changes, regardless of context. The Renovate automation and PR body provide sufficient rationale (major-version bumps for actions/checkout, actions/setup-go, actions/upload-artifact, codecov/codecov-action, and softprops/action-gh-release, all still pinned by full commit SHA), so this is surfaced for reviewer awareness rather than as a blocker.

Info

  • [provenance-warning] N/A — Prior review context was discarded: PRIOR_REVIEW_PROVENANCE=unverifiable-wrong-app. Post-creation edits cannot be attributed to a specific actor, so any prior review comment was not trusted. This review treats all findings as first-time assessments; severity anchoring was skipped.
  • [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings (model availability error, HTTP 404). For a mechanical value-only diff like this (SHA-pin bumps whose new values follow the same uses: owner/action@<sha> # v<x.y.z> pattern as surrounding context), the sub-agent's own early-exit rule would have produced no findings.
  • [sub-agent-failure] N/A — The risk-assessment pre-pass did not return a risk score (model availability error, HTTP 404). Risk assessment is informational; the review verdict is unaffected. Independent signals: 5 files / +11-11 lines / Renovate bot / all changes are pinned-SHA bumps under .github/workflows/ — consistent with the PR's existing size: XS and risk/elevated labels (elevated only because of the .github/ protected path, not because of change substance).

Notes

  • All bumped uses: lines remain pinned by full 40-char commit SHA — no downgrade to tag references.
  • No permissions:, secrets:, or on: triggers were modified. No pull_request_target or workflow_run triggers exist in the affected workflows, so actions/checkout@v7's new fork-PR block does not change behavior for this repo.
  • All action usages in the diff are fully upgraded (no partial upgrades — e.g., all 6 actions/checkout occurrences moved from v6.1.0 to v7.0.1).
  • Compatibility watch-item (not a finding): codecov/codecov-action@v7 and softprops/action-gh-release@v3 require Node 24 runners. The workflows use ubuntu-latest, which supports Node 24.
Previous run (3)

Review

Findings

Low

  • [protected-path] .github/workflows/ — This PR modifies five files under the protected path .github/workflows/ (codeql.yml, pre-merge-ci.yaml, push-bundles.yaml, release.yaml, scorecards.yml). The repository's renovate.json (extending github>conforma/.github//config/renovate/renovate.json) explicitly authorizes the automated GitHub Actions update pattern, and every action remains SHA-pinned with a version comment matching the existing convention. Human approval is nevertheless always required for protected-path changes: please confirm the new major versions (actions/checkout v7.0.1, actions/setup-go v7.0.0, actions/upload-artifact v7.0.1, codecov/codecov-action v7.0.0, softprops/action-gh-release v3.0.3) are acceptable and their behavioral/permission changes (notably codecov-action's Node 24 requirement and action-gh-release's Node 24 runtime) are compatible with your runners.
Previous run (4)

Review

Findings

Medium

  • [protected-path] .github/workflows/ — This PR modifies 5 files under .github/workflows/ (codeql.yml, pre-merge-ci.yaml, push-bundles.yaml, release.yaml, scorecards.yml), which matches the protected-path prefix .github/. Sub-agent analysis found no correctness, security, or style concerns: the change is a mechanical Renovate SHA-pin major-version bump of five GitHub Actions (actions/checkout v6.1.0→v7.0.1, actions/setup-go v6.5.0→v7.0.0, actions/upload-artifact v6.0.0→v7.0.1, codecov/codecov-action v5.5.2→v7.0.0, softprops/action-gh-release v2.6.2→v3.0.3). All actions remain pinned to a full 40-char commit SHA with a # vX.Y.Z comment; no permissions:, secrets:, env:, or trigger blocks are modified. None of the touched workflows use pull_request_target or workflow_run, so actions/checkout v7's fork-checkout block is a no-op here. The repository's renovate.json at the root authorizes Renovate for the github_actions manager (intent-coherence sub-agent finding: scope-authorization-implicit). Human approval is always required for protected-path changes regardless of context.
    Remediation: A human reviewer must approve the change per governance for .github/ files. Confirm the ubuntu-latest runners in scope support Node 24 (required by codecov/codecov-action v6/v7 and softprops/action-gh-release v3) before merging.
Previous run (5)

Review

Findings

High

  • [protected-path] .github/workflows/codeql.yml — All 5 modified files are under the .github/ protected path (codeql.yml, pre-merge-ci.yaml, push-bundles.yaml, release.yaml, scorecards.yml). This PR has no linked issue providing justification for modifying governance/infrastructure files. Human approval is required for all protected-path changes regardless of the mechanical nature of the update.
    Remediation: Obtain explicit human maintainer approval for these workflow file changes.

Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR
Previous run (6)

Review

Findings

High

  • [protected-path] .github/workflows/ — All 5 changed files (codeql.yml, pre-merge-ci.yaml, push-bundles.yaml, release.yaml, scorecards.yml) are under the .github/ protected path. This PR has no linked issue providing justification for modifying governance/infrastructure files. While the changes are mechanical GitHub Actions version bumps by renovate[bot] and the repository has a renovate.json configuration authorizing automated dependency updates, human approval is always required for protected-path changes.
    Remediation: A maintainer should review and explicitly approve these CI/CD configuration changes.

Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR
Previous run (7)

Review

Findings

High

  • [protected-path] .github/workflows/ — This PR modifies 5 files under the protected .github/ path: codeql.yml, pre-merge-ci.yaml, push-bundles.yaml, release.yaml, scorecards.yml. While the changes are mechanical GitHub Actions version bumps from renovate[bot] (with renovate.json configured in the repo), the PR has no linked issue justifying these protected-path modifications. Human approval is always required for protected-path changes.
    Remediation: A human reviewer should verify that the major version bumps (checkout v6→v7, setup-go v6→v7, upload-artifact v6→v7, codecov v5→v7, action-gh-release v2→v3) are compatible with the existing workflow configurations, then explicitly approve.
Previous run (8)

Review

Findings

High

  • [protected-path] .github/workflows/ — All 5 modified files (codeql.yml, pre-merge-ci.yaml, push-bundles.yaml, release.yaml, scorecards.yml) are under the .github/ protected path. This PR has no linked issue providing explicit authorization for modifying governance/infrastructure files. While renovate.json configures Renovate for this repository (providing implicit authorization for dependency updates), human approval is always required for protected-path changes. The major version bumps (actions/checkout v6→v7, actions/setup-go v6→v7, actions/upload-artifact v6→v7, codecov/codecov-action v5→v7, softprops/action-gh-release v2→v3) should be verified for breaking changes before merging.
    Remediation: A human maintainer should review the release notes for each major version bump, verify compatibility with the existing workflow configurations, and approve the protected-path changes.
Previous run (9)

Review

Verdict: Approve

Mechanical Renovate dependency bump updating five GitHub Actions to their next major versions. All changes are SHA pin + version comment swaps with no structural, permission, or configuration modifications.

Dimension Summary

Dimension Result
Correctness ✅ No issues — all parameters (go-version-file, cache, use_oidc, fetch-depth, persist-credentials, make_latest, etc.) confirmed compatible with new major versions
Security ✅ No issues — SHA pinning consistent, permissions unchanged, no secrets exposure, no trigger changes
Intent & coherence ✅ Mechanical change — authorization implicit
Style & conventions ✅ Values follow identical pattern to surrounding context
Documentation currency ✅ No docs reference these action versions
Cross-repo contracts ⊘ Not applicable — no exported interfaces modified

Key Verifications

  • actions/checkout v7 breaking change (blocks fork PR checkout on pull_request_target/workflow_run) does not affect any of the 5 updated workflows — none use those triggers.
  • codecov/codecov-action v5.5.2 → v7.0.0 — skips v6 but the use_oidc: true parameter remains supported. The required id-token: write permission is correctly declared.
  • softprops/action-gh-release v2.5.0 → v3.0.2 — Node 20 → Node 24 runtime only; all parameters used in release.yaml remain unchanged.
  • actions/upload-artifact v7 — new archive input defaults to true, preserving backward compatibility with existing usage.
  • actions/setup-go v7 — ESM migration only; go-version-file and cache inputs unchanged.

All SHA pins verified as resolving to their claimed version tags.

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

  • .github/workflows/codeql.yml
  • .github/workflows/pre-merge-ci.yaml
  • .github/workflows/push-bundles.yaml
  • .github/workflows/release.yaml
  • .github/workflows/scorecards.yml
Previous run (10)

Review

Verdict: Approve

Summary

This Renovate PR updates four GitHub Actions to their next major versions across five workflow files. All changes are mechanical SHA-pin + version-comment swaps (9 additions, 9 deletions).

Action Update Files
actions/checkout v6.0.2 → v7.0.0 codeql, pre-merge-ci, push-bundles, release, scorecards
actions/upload-artifact v6.0.0 → v7.0.1 scorecards
codecov/codecov-action v5.5.2 → v7.0.0 pre-merge-ci
softprops/action-gh-release v2.5.0 → v3.0.2 release

Correctness ✅

  • All four SHA pins verified against upstream GitHub tags via API — each resolves to the correct version.
  • All actions/checkout references (6 occurrences) use the identical SHA. No inconsistencies.
  • No stale old-version SHA references remain in any files outside the diff (verified via grep across the entire repo, including 4 other workflow files).
  • Input compatibility verified for all actions:
    • actions/checkout v7: fetch-depth, persist-credentials inputs unchanged. The v7 breaking change (blocking fork PR checkout for pull_request_target) does not affect this repo — none of the modified workflows use pull_request_target.
    • codecov/codecov-action v7: use_oidc, flags, fail_ci_if_error inputs all present and unchanged in v7 action.yml. The v5→v7 jump (skipping v6) is safe — v6 was only a Node 24 runtime upgrade.
    • softprops/action-gh-release v3: name, tag_name, body, make_latest, generate_release_notes inputs all present. Only change is Node 20→24 runtime.
    • actions/upload-artifact v7: name, path, retention-days inputs all present. New archive parameter defaults to true, preserving existing behavior.

Security ✅

  • All actions remain SHA-pinned to full 40-character commit hashes (not floating tags).
  • No permissions: block changes in any workflow file.
  • No secrets exposure changes — push-bundles.yaml secret references are untouched.
  • No injection patterns introduced — no new run: steps or ${{ }} interpolations.
  • No prompt injection or Unicode steganography detected in PR body or workflow files.

Intent & Scope ✅

Mechanical Renovate bot dependency update — authorization is implicit from the automated, value-only nature of the change.

Style ✅

All changes follow the established action@sha # version pinning pattern consistently.

Documentation ✅

No documentation references specific CI action versions. No staleness concerns.

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

  • .github/workflows/codeql.yml
  • .github/workflows/pre-merge-ci.yaml
  • .github/workflows/push-bundles.yaml
  • .github/workflows/release.yaml
  • .github/workflows/scorecards.yml

Labels: PR modifies GitHub Actions workflow files

Previous run (11)

Review of #1679 — Update GitHub Actions (major)

Verdict: ✅ Approve

This PR is a routine Renovate dependency update that bumps four GitHub Actions to new major versions across five workflow files. All changes are pure commit SHA pin swaps with updated version comments — no workflow logic, permissions, inputs, or secrets are modified.

Actions Updated

Action Change Files
actions/checkout v6.0.2 → v7.0.0 codeql, pre-merge-ci, push-bundles, release (×2), scorecards
actions/upload-artifact v6.0.0 → v7.0.1 scorecards
codecov/codecov-action v5.5.2 → v7.0.0 pre-merge-ci
softprops/action-gh-release v2.5.0 → v3.0.1 release

Breaking Change Analysis

  • actions/checkout v7 blocks fork checkout for pull_request_target and workflow_run triggers. None of the five updated workflows use these triggers — all use pull_request, push, schedule, workflow_dispatch, or branch_protection_rule. ✅
  • actions/upload-artifact v7 adds a new optional archive parameter for direct uploads. Existing usage (name, path, retention-days) is unaffected. ✅
  • codecov/codecov-action v7 skips v6 (Codecov released v6 as a Node 24 bridge and v6.0.2 is described as "a copy of v7.0.0"). The existing inputs (use_oidc: true, flags, fail_ci_if_error) remain valid. The job already has id-token: write permission for OIDC. ✅
  • softprops/action-gh-release v3 is a Node 20→24 runtime upgrade with no API surface changes. Existing inputs (name, tag_name, body, make_latest, generate_release_notes) are fully supported. ✅

Security

  • All action references use full 40-character commit SHA pins — supply chain best practice. ✅
  • No permissions, secrets, or trigger changes. ✅
  • All updated actions are from well-known, trusted sources. ✅
  • The Codecov keybase account migration note (codecovsecurity → codecovsecops) uses the original GPG key — this is a legitimate infrastructure change, not a compromise indicator. ✅

No findings.

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

  • .github/workflows/codeql.yml
  • .github/workflows/pre-merge-ci.yaml
  • .github/workflows/push-bundles.yaml
  • .github/workflows/release.yaml
  • .github/workflows/scorecards.yml
Previous run (12)

Review

Findings

High

  • [protected-path] .github/workflows/ — All five modified files are under the .github/ protected path. This PR has no linked issue providing authorization for modifying governance/infrastructure files. Human approval is required for all protected-path changes.
    Remediation: Link an authorizing issue or obtain explicit human maintainer approval before merging.

Medium

  • [supply-chain integrity] .github/workflows/pre-merge-ci.yaml:77 — codecov/codecov-action is being bumped from v5.5.2 to v7.0.0, a two-major-version jump. This action receives an OIDC token (use_oidc: true) which makes it security-sensitive. The SHA fb8b3582c8e4def4969c97caa2f19720cb33a72f should be verified against the upstream repository.
    Remediation: Verify the SHA matches the v7.0.0 tag at https://github.com/codecov/codecov-action. Review the changelog for v6 and v7 breaking changes, especially around OIDC token handling.

Low

  • [supply-chain integrity] .github/workflows/release.yaml:162 — softprops/action-gh-release is bumped from v2.5.0 to v3.0.1. This action runs with contents: write permission. The major version bump should be verified for behavioral changes.

  • [supply-chain integrity] .github/workflows/codeql.yml:67 — actions/checkout is bumped from v6.0.2 to v7.0.0 across five workflow files (six occurrences). As a first-party GitHub action the risk is lower, but the major version bump may change default behaviors.

Info

  • [sub-agent-failure] — The style-conventions sub-agent did not return findings: model not available. No style findings were evaluated for this review.
Previous run (13)

Review

Findings

High

  • [protected-path] .github/workflows/ — All five modified files (codeql.yml, pre-merge-ci.yaml, push-bundles.yaml, release.yaml, scorecards.yml) are under the .github/ protected path. This PR has no linked issue providing justification for modifying governance/infrastructure files. Human approval is required for all protected-path changes.

Medium

  • [edge-case] .github/workflows/pre-merge-ci.yaml:77 — codecov/codecov-action is being bumped from v5.5.2 to v7.0.0, skipping the entire v6 major release line. The workflow uses use_oidc: true (line 80) for authentication and has the required id-token: write permission (line 39). The compatibility of this parameter with v7 should be verified. Note that fail_ci_if_error: false (line 82) means a broken upload would be silent.
    Remediation: Run the pre-merge CI workflow on this branch to confirm coverage upload succeeds before merging. Check codecov-action v7 documentation for any changes to the use_oidc parameter.

Info

  • [edge-case] .github/workflows/release.yaml:162 — softprops/action-gh-release bumped from v2.5.0 to v3.0.0 (Node 20 → Node 24 runtime). The workflow uses runs-on: ubuntu-latest, so Node 24 compatibility is not a concern.
  • [permission-reduction] .github/workflows/codeql.yml:67 — actions/checkout upgraded from v6.0.2 to v7.0.0. All checkout references across the five workflows are pinned to the same commit SHA, ensuring consistency.
  • [permission-reduction] .github/workflows/scorecards.yml:84 — actions/upload-artifact upgraded from v6.0.0 to v7.0.1 with pinned SHA. The existing usage pattern remains compatible.
Previous run (14)

Review

Findings

High

  • [protected-path] .github/workflows/pre-merge-ci.yaml, .github/workflows/release.yaml, .github/workflows/scorecards.yml — All three modified files are under .github/, a protected path. This PR has no linked issue authorizing the changes. Human approval is required for all protected-path changes regardless of context.
    Remediation: Link an issue authorizing these dependency updates, or obtain explicit human maintainer approval.

Medium

  • [api-contract] .github/workflows/pre-merge-ci.yaml:77 — codecov/codecov-action is updated from v5.5.2 to v7.0.0, skipping major version v6 entirely. The use_oidc: true parameter (line 80) may no longer be a recognized input in v7. Because fail_ci_if_error: false (line 82), a failure from an unrecognized input would be silent — coverage uploads could stop working without any CI signal.
    Remediation: Verify against codecov-action v7 docs that use_oidc is still supported. Consider temporarily setting fail_ci_if_error: true or reviewing the first run's logs.

  • [supply-chain] .github/workflows/pre-merge-ci.yaml:77 — codecov/codecov-action is bumped from v5.5.2 to v7.0.0, skipping v6. The pinned commit hash fb8b3582c8e4def4969c97caa2f19720cb33a72f should be verified against the upstream v7.0.0 tag. This action runs with id-token: write (line 39), so a compromised or mislabeled version could exfiltrate an OIDC token. See also: [api-contract] finding at this location.
    Remediation: Verify the commit hash: git ls-remote https://github.com/codecov/codecov-action refs/tags/v7.0.0.

Low

  • [api-contract] .github/workflows/release.yaml:162 — softprops/action-gh-release is updated from v2.5.0 to v3.0.0. The inputs used (name, tag_name, body, make_latest, generate_release_notes) are core but major bumps can change semantics. See also: [supply-chain] finding at this location.

  • [supply-chain] .github/workflows/release.yaml:162 — softprops/action-gh-release is bumped from v2.5.0 to v3.0.0. This action runs with contents: write (line 135). The pinned hash should be verified against the upstream v3.0.0 tag. See also: [api-contract] finding at this location.

Info

  • [api-contract] .github/workflows/scorecards.yml:84 — actions/upload-artifact is updated from v6.0.0 to v7.0.1. Inputs used (name, path, retention-days) are basic and no download-artifact usage exists in this repo. Minimal risk.

  • [supply-chain] .github/workflows/scorecards.yml:84 — actions/upload-artifact is a first-party GitHub action. Supply-chain risk is minimal for hash-pinned first-party actions.

  • [sub-agent-failure] — The style-conventions sub-agent did not return findings due to model unavailability. Non-critical for a mechanical version bump PR.

Previous run (15)

Review

Findings

High

  • [protected-path] .github/workflows/pre-merge-ci.yaml, .github/workflows/release.yaml, .github/workflows/scorecards.yml — All three modified files are under the .github/ protected path. This PR has no linked issue justifying the changes to governance/infrastructure files. Human approval is required for all protected-path changes.

Medium

  • [api-contract] .github/workflows/pre-merge-ci.yaml:80 — The use_oidc: true input is used with codecov/codecov-action, but this PR jumps from v5.5.2 to v7.0.0, skipping v6 entirely. In codecov-action v7, OIDC became the default authentication method and the use_oidc input may have been removed. GitHub Actions silently ignores unknown inputs so this won't cause a build failure, but the dead configuration is misleading. Verify that: (1) OIDC authentication works correctly without explicit opt-in with the existing id-token: write permission (line 39), and (2) no other v6/v7 breaking changes affect the flags or fail_ci_if_error inputs. Accumulating two major versions of breaking changes warrants review of both migration guides.

Low

  • [api-contract] .github/workflows/release.yaml:162 — softprops/action-gh-release is bumped from v2.5.0 to v3.0.0. The release notes indicate this is primarily a Node 20 to Node 24 runtime migration with no API changes, but the workflow uses make_latest: false and generate_release_notes: false which should be verified against v3 documentation. The release workflow runs on a weekly schedule, so a silent misconfiguration could produce unexpected release settings.

Info

  • [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model unavailable. This is a non-critical gap; this dimension covers naming and code organization patterns which are not applicable to version-pin-only changes.

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/main-major-github-actions branch from 83d9f86 to 3614c3a Compare June 11, 2026 18:06
@fullsend-ai-review

fullsend-ai-review Bot commented Jun 11, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 6:08 PM UTC · Completed 6:15 PM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/main-major-github-actions branch from 3614c3a to d88fa78 Compare June 18, 2026 20:48
@fullsend-ai-review

fullsend-ai-review Bot commented Jun 18, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 8:51 PM UTC · Completed 8:58 PM UTC
Commit: 47d3320 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/main-major-github-actions branch from 476f3ab to f2072f5 Compare August 14, 2026 19:37
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 7:38 PM UTC · Completed 7:49 PM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/main-major-github-actions branch from f2072f5 to 53b26c8 Compare September 4, 2026 22:30
@renovate
renovate Bot requested a review from a team as a code owner September 4, 2026 22:30
@fullsend-ai-review

fullsend-ai-review Bot commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 10:32 PM UTC · Completed 10:41 PM UTC

Commit: 4ad3612 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $3.62

@fullsend-ai-review fullsend-ai-review Bot added the risk/moderate PR risk: moderate label Sep 4, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Risk Assessment: moderate (2/5)

Details

Small SHA-pinned Renovate bump of five GitHub Actions across CI workflows with no logic changes; protected-path and major-version bumps warrant moderate rather than low risk.

Previous run

Risk Assessment: moderate (2/5)

Details

Small renovate-bot GitHub Actions version bump touching only CI workflow files; low churn, no security-sensitive or dependency changes, though protected-path and CI-workflow signals lift the score slightly above minimum.

Previous run (2)

Risk Assessment: elevated (3/5)

Details

Small, SHA-pinned Renovate bump but touches only protected .github/ CI infrastructure with five simultaneous major-version action upgrades and no test coverage, warranting elevated (but not high) risk.

Previous run (3)

Risk Assessment: moderate (2/5)

Details

Multiple protected CI workflow files touched with recent changes; Renovate bot making standard dependency pin updates; low git churn and single-author files across 90 days mitigate risk.

@fullsend-ai-review
fullsend-ai-review Bot dismissed stale reviews from themself September 4, 2026 22:41

Superseded by updated review

@fullsend-ai-review fullsend-ai-review Bot added the requires-manual-review Review requires human judgment label Sep 4, 2026
@renovate
renovate Bot force-pushed the renovate/main-major-github-actions branch from 53b26c8 to c47f453 Compare September 7, 2026 22:03
@fullsend-ai-review

fullsend-ai-review Bot commented Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 10:04 PM UTC · Completed 10:13 PM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $4.66

@fullsend-ai-review fullsend-ai-review Bot added risk/elevated PR risk: elevated and removed risk/moderate PR risk: moderate labels Sep 7, 2026
@renovate
renovate Bot force-pushed the renovate/main-major-github-actions branch 2 times, most recently from 691a7df to 9a204dc Compare September 10, 2026 17:17
@coderabbitai

coderabbitai Bot commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 26cc3145-56c8-4709-b727-a94675b322c6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

@fullsend-ai-review

fullsend-ai-review Bot commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 5:18 PM UTC · Completed 5:24 PM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.05

@fullsend-ai-review fullsend-ai-review Bot removed the risk/elevated PR risk: elevated label Sep 10, 2026
robnester-rh
robnester-rh approved these changes Sep 14, 2026
View reviewed changes

@robnester-rh robnester-rh left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Comment thread .github/workflows/pre-merge-ci.yaml
Comment thread .github/workflows/pre-merge-ci.yaml
Comment thread .github/workflows/pre-merge-ci.yaml
@renovate
renovate Bot force-pushed the renovate/main-major-github-actions branch from 9a204dc to 6738d98 Compare September 15, 2026 13:33
@fullsend-ai-review

fullsend-ai-review Bot commented Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:34 PM UTC · Completed 1:42 PM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $3.08

@fullsend-ai-review fullsend-ai-review Bot added the risk/moderate PR risk: moderate label Sep 15, 2026
@renovate
renovate Bot force-pushed the renovate/main-major-github-actions branch from 6738d98 to aefa8c5 Compare September 15, 2026 18:22
@fullsend-ai-review

fullsend-ai-review Bot commented Sep 15, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 6:23 PM UTC · Completed 6:30 PM UTC

Commit: e8f0a9f · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.65

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@robnester-rh robnester-rh robnester-rh approved these changes
+1 more reviewer
@fullsend-ai-review fullsend-ai-review[bot] fullsend-ai-review[bot] left review comments
Reviewers whose approvals may not affect merge requirements

At least 2 approving reviews are required to merge this pull request.

Assignees

No one assigned

Labels

github_actions Pull requests that update GitHub Actions code main major renovate requires-manual-review Review requires human judgment risk/moderate PR risk: moderate size: XS

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@robnester-rh