build(deps): bump the actions group with 5 updates - #258
Merged
Conversation
Bumps the actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.3.1` | `7.0.1` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.3` | `4.37.6` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.3` | `4.37.6` | | [azure/login](https://github.com/azure/login) | `3.0.0` | `3.0.1` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `4.1.1` | `4.2.2` | Updates `actions/checkout` from 4.3.1 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@34e1148...3d3c42e) Updates `github/codeql-action/init` from 4.37.3 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e4fba86...5595cca) Updates `github/codeql-action/analyze` from 4.37.3 to 4.37.6 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e4fba86...5595cca) Updates `azure/login` from 3.0.0 to 3.0.1 - [Release notes](https://github.com/azure/login/releases) - [Commits](Azure/login@532459e...f5d393a) Updates `actions/attest-build-provenance` from 4.1.1 to 4.2.2 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@0f67c3f...4d10147) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: azure/login dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/attest-build-provenance dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![my-reviewer-agent[bot]](https://avatars.githubusercontent.com/in/4343504?s=60&v=4){kind=small}
There was a problem hiding this comment.
리뷰 요약 (#258 — actions 그룹 5개 업데이트)
워크플로 액션 pin을 갱신하는 변경으로, 4개 파일에서 SHA pin과 주석 버전만 바뀌었고 로직 변경은 없습니다. 모든 pin을 upstream에서 직접 검증했습니다.
actions/checkout3d3c42e5aac5ba805825da76410c181273ba90b1→ 실제v7.0.1태그와 일치github/codeql-action5595ccaf912efad79be6eef63a5619ff05969be3→ 실제v4.37.6태그와 일치azure/loginf5d393ae46f8fde4be8b75f32e3fc50e654ad0ca→ 실제v3.0.1태그와 일치actions/attest-build-provenance4d101475d8b20a2381f78447822ac1eab6504dd8→ 실제v4.2.2태그와 일치
즉 SHA와 주석 버전이 어긋난 곳이 없고, 가변 태그가 아닌 커밋 SHA로 고정되어 공급망 관점의 pin 규율이 유지됩니다.
확인한 사항
.github/workflows/ci.yml,release.yml,codeql.yml,k8s-contract.yml전부에서checkout이 일관되게 같은 SHA로 갱신되었고, 누락된checkout호출은 없습니다.- 모든
checkout스텝의with: persist-credentials: false가 그대로 보존되었습니다. 릴리스 워크플로처럼contents: write,attestations: write권한이 있는 잡에서 이 옵션이 빠지면 토큰이.git/config에 남으므로 중요한 지점인데, 이 PR은 그 설정을 건드리지 않았습니다. fetch-depth: 0, 태그 검증 주석 등 보안 관련 부수 설정도 모두 유지되었습니다.actions/checkout은 v4 → v7로 메이저가 두 단계 올라갔지만, v5 이상은 Node 20→24 런타임 이동과 최소 Actions Runner 버전 상향이 주된 변경이라 워크플로 문법 변경은 필요 없습니다. 다만korvid-runners셀프호스티드 러너의 runner 버전이 낮으면Node24런타임을 찾지 못해 실패할 수 있으니, self-hosted 잡이 실제로 통과하는지 CI 결과로 한 번 확인해 주세요.github/codeql-actionv4.37.3 → v4.37.6은 패치 범위이며init과analyze가 동일 SHA로 함께 갱신되어 버전 불일치가 없습니다.
버그, 보안 저하, 성능 문제를 발견하지 못했습니다.
APPROVE
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 5 updates:
4.3.17.0.14.37.34.37.64.37.34.37.63.0.03.0.14.1.14.2.2Updates
actions/checkoutfrom 4.3.1 to 7.0.1Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Updates
github/codeql-action/initfrom 4.37.3 to 4.37.6Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
5595ccaMerge pull request #4071 from github/update-v4.37.6-6a9359a1bec9c757Add change note for PR 407045c8742Update changelog for v4.37.66a9359aMerge pull request #4070 from github/mbg/remote-address/change-file-default065cdc0ChangeDEFAULT_CONFIG_FILE_NAMEf99dd5aMerge pull request #4066 from github/dependabot/npm_and_yarn/js-yaml-5.2.21804b21Merge pull request #4068 from github/mergeback/v4.37.5-to-main-d1ba80a13020a2fRebuild93c3a5aUpdate changelog and version after v4.37.5d1ba80aMerge pull request #4067 from github/update-v4.37.5-1cd4d01d5Updates
github/codeql-action/analyzefrom 4.37.3 to 4.37.6Release notes
Sourced from github/codeql-action/analyze's releases.
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
5595ccaMerge pull request #4071 from github/update-v4.37.6-6a9359a1bec9c757Add change note for PR 407045c8742Update changelog for v4.37.66a9359aMerge pull request #4070 from github/mbg/remote-address/change-file-default065cdc0ChangeDEFAULT_CONFIG_FILE_NAMEf99dd5aMerge pull request #4066 from github/dependabot/npm_and_yarn/js-yaml-5.2.21804b21Merge pull request #4068 from github/mergeback/v4.37.5-to-main-d1ba80a13020a2fRebuild93c3a5aUpdate changelog and version after v4.37.5d1ba80aMerge pull request #4067 from github/update-v4.37.5-1cd4d01d5Updates
azure/loginfrom 3.0.0 to 3.0.1Release notes
Sourced from azure/login's releases.
Commits
f5d393aMerge remote-tracking branch 'origin/master' into releases/v3.0.1e8cd11fReplacing hardcoded version v2 with v3 (#603)73730b8prepare release v3.0.1f4dcb80Escape single quotes in PowerShell login script inputs (#599)e82415aAdd IDE files to .gitignore (#597)a842007Update CODEOWNERS (#598)9dfca58use the latest auzre/powershell@v3 (#581)Updates
actions/attest-build-provenancefrom 4.1.1 to 4.2.2Release notes
Sourced from actions/attest-build-provenance's releases.
Commits
4d10147Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (#862)e3fe62eBump the actions-minor group with 2 updates (#860)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions