🚨 Update github actions (main) (major)#3132
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests.
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
2 times, most recently
from
e38a026 to
df58afe
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
2 times, most recently
from
16f9391 to
31eb2bc
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
3 times, most recently
from
042a0f4 to
ddedbe9
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
7 times, most recently
from
31ca854 to
e7d8189
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
3 times, most recently
from
e2a726f to
1182541
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
from
1182541 to
9c7fcb9
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
3 times, most recently
from
9affe55 to
837e0b3
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
2 times, most recently
from
85b64e5 to
ee9b6d9
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
2 times, most recently
from
baaf71f to
2dca731
Compare
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
from
2dca731 to
ee64288
Compare
ReviewFindingsHigh
Medium
Low
Info
Previous runReviewFindingsHigh
Medium
Low
Info
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
| - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | ||
| id: generate-token | ||
| with: | ||
| app-id: ${{ vars.EC_AUTOMATION_APP_ID }} |
There was a problem hiding this comment.
[low] api-contract
actions/create-github-app-token v3.1.0 deprecated the app-id input in favor of client-id. The workflow still uses app-id. While deprecated inputs typically continue to work, this should be migrated to avoid future breakage.
Suggested fix: Replace app-id with client-id in the create-github-app-token step.
|
|
||
| - name: Upload test coverage artifacts | ||
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 | ||
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 |
There was a problem hiding this comment.
[low] api-contract
upload-artifact v6 to v7 and download-artifact v7 to v8 are both major bumps used cross-job. Confirm in release notes that upload v7 artifacts can be downloaded by download v8.
renovate
Bot
force-pushed
the
renovate/main-major-github-actions
branch
from
ee64288 to
ea04860
Compare
|
🤖 Finished Review · ✅ Success · Started 9:18 PM UTC · Completed 9:27 PM UTC |
| GOPRIVATE: github.com/conforma/go-containerregistry | ||
|
|
||
| - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 | ||
| - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 |
There was a problem hiding this comment.
[high] privilege-escalation
The bump from actions/create-github-app-token v2 to v3 introduces a breaking change in default token scoping. In v2, omitting the repositories input scoped the token to the current repository. In v3, omitting repositories (when owner is also omitted) may grant the token access to ALL repositories where the GitHub App is installed. The workflow does not specify repositories or owner, so the token generated for the peter-evans/create-pull-request step could have broader repository access than intended, violating least-privilege.
Suggested fix: Explicitly add repositories: ${{ github.event.repository.name }} to the actions/create-github-app-token step to preserve the v2 behavior of scoping the token to only the current repository.
|
|
||
| - name: Upload unit test coverage report | ||
| uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4 | ||
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 |
There was a problem hiding this comment.
[medium] api-contract
codecov/codecov-action is bumped from v5.5.4 to v7.0.0, skipping v6 entirely. The disable_search input parameter is used in all four codecov upload steps. If disable_search is no longer supported in v7, Codecov may silently search for and upload unintended coverage files instead of using only the explicitly specified files. Additionally, skipping a major version makes incremental change auditing harder, particularly relevant given codecov's prior supply-chain compromise history.
Suggested fix: Verify that disable_search: true is still a supported input in codecov/codecov-action v7.0.0 by checking the action's v7 action.yml. Review the v6 and v7 changelogs for changes in secret handling or upload behavior.
| @@ -202,7 +202,7 @@ jobs: | |||
| git push -f --tags | |||
|
|
|||
| - name: Rolling release | |||
There was a problem hiding this comment.
[low] api-contract
softprops/action-gh-release is bumped from v2 to v3. The make_latest parameter is used in both the rolling release and versioned release steps. If v3 changed this input's type or semantics, release behavior could be affected.
Suggested fix: Verify that softprops/action-gh-release v3 still supports the make_latest input with the same semantics.
This PR contains the following updates:
v5.0.0→v6.0.0v2.2.2→v3.2.0v4.0.5→v5.0.0v7.0.0→v8.0.1v6.0.0→v7.0.1v4.0.0→v5.0.0v5.5.4→v7.0.0v3.7.0→v4.1.0v2→v3Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
actions/configure-pages (actions/configure-pages)
v6.0.0Compare Source
Changelog
See details of all code changes since previous release.
v6Compare Source
actions/create-github-app-token (actions/create-github-app-token)
v3.2.0Compare Source
Features
repositoriesinput (#372) (85eb8dd)Bug Fixes
v3.1.1Compare Source
Bug Fixes
v3.1.0Compare Source
Bug Fixes
Features
client-idinput and deprecateapp-id(#353) (e6bd4e6)v3.0.0Compare Source
NODE_USE_ENV_PROXYfor proxy support (#342) (4451bcb)Bug Fixes
BREAKING CHANGES
v3Compare Source
actions/deploy-pages (actions/deploy-pages)
v5.0.0Compare Source
Changelog
See details of all code changes since previous release.
v5Compare Source
actions/download-artifact (actions/download-artifact)
v8.0.1Compare Source
What's Changed
Full Changelog: actions/download-artifact@v8...v8.0.1
v8.0.0Compare Source
v8 - What's new
Direct downloads
To support direct uploads in
actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks theContent-Typeheader ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the newskip-decompressparameter tofalse.Enforced checks (breaking)
A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the
digest-mismatchparameter. To be secure by default, we are now defaulting the behavior toerrorwhich will fail the workflow run.ESM
To support new versions of the @actions/* packages, we've upgraded the package to ESM.
What's Changed
errorby @danwkennedy in #461Full Changelog: actions/download-artifact@v7...v8.0.0
v8Compare Source
actions/upload-artifact (actions/upload-artifact)
v7.0.1Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v7...v7.0.1
v7.0.0Compare Source
v7 What's new
Direct Uploads
Adds support for uploading single files directly (unzipped). Callers can set the new
archiveparameter tofalseto skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. Thenameparameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.ESM
To support new versions of the
@actions/*packages, we've upgraded the package to ESM.What's Changed
New Contributors
Full Changelog: actions/upload-artifact@v6...v7.0.0
v7Compare Source
actions/upload-pages-artifact (actions/upload-pages-artifact)
v5.0.0Compare Source
Changelog
include-hidden-filesinput @jonchurch (#137)See details of all code changes since previous release.
v5Compare Source
codecov/codecov-action (codecov/codecov-action)
v7.0.0Compare Source
v7Compare Source
v6.0.2Compare Source
v6.0.1Compare Source
What's Changed
Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1
v6.0.0Compare Source
What's Changed
Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0
v6Compare Source
v5.5.5Compare Source
docker/setup-qemu-action (docker/setup-qemu-action)
v4.1.0Compare Source
resetinput to uninstall current emulators by @crazy-max in #21Full Changelog: docker/setup-qemu-action@v4.0.0...v4.1.0
v4.0.0Compare Source
Full Changelog: docker/setup-qemu-action@v3.7.0...v4.0.0
v4Compare Source
softprops/action-gh-release (softprops/action-gh-release)
v3.0.0Compare Source
3.0.0is a major release that moves the action runtime from Node 20 to Node 24.Use
v3on GitHub-hosted runners and self-hosted fleets that already support theNode 24 Actions runtime. If you still need the last Node 20-compatible line, stay on
v2.6.2.What's Changed
Other Changes 🔄
@types/nodeto the Node 24 line and allow future Dependabot updatesv3;v2remains pinned to the latest2.xreleasev3Compare Source
Configuration
📅 Schedule: (UTC)
* 0-3 * * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.