chore(deps): pin GitHub Actions to verified SHAs and refresh versions#122
Closed
dependabot[bot] wants to merge 2 commits into
Closed
chore(deps): pin GitHub Actions to verified SHAs and refresh versions#122dependabot[bot] wants to merge 2 commits into
dependabot[bot] wants to merge 2 commits into
Conversation
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
force-pushed
the
dependabot/github_actions/github-actions-ac25b41920
branch
from
58a012d to
2749686
Compare
dependabot
Bot
force-pushed
the
dependabot/github_actions/github-actions-ac25b41920
branch
2 times, most recently
from
6c74619 to
ad75368
Compare
dependabot
Bot
force-pushed
the
dependabot/github_actions/github-actions-ac25b41920
branch
2 times, most recently
from
37e1ab1 to
f68baa0
Compare
dependabot
Bot
force-pushed
the
dependabot/github_actions/github-actions-ac25b41920
branch
from
f68baa0 to
92d7ded
Compare
Refresh the github-actions group to current stable releases, each pinned to the full commit SHA of its tag (verified against upstream) so the ref cannot be moved out from under us. All selected versions are >7 days old to dodge freshly-published compromised releases. - actions/checkout v4.2.2 -> v6.0.3 - peter-evans/create-pull-request v7.0.5 -> v8.1.1 - github/codeql-action v3.28.0 -> v4.36.2 (clears CVE-2025-24362) - softprops/action-gh-release v2.2.0 -> v3.0.0 - pnpm/action-setup v4.0.0 -> v6.0.8 - actions/setup-node v4.1.0 -> v6.4.0 The prior dependabot branch pinned action-gh-release to a SHA that was actually v2.6.1 while the comment claimed v2.2.0; comments now match SHAs.
bestdan
force-pushed
the
dependabot/github_actions/github-actions-ac25b41920
branch
from
92d7ded to
d67620a
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
This Dependabot PR updates pinned GitHub Action revisions across the repo’s CI/release automation workflows and the shared composite setup action.
Changes:
- Bump
actions/checkoutpins across workflows tov6.0.3. - Bump CodeQL workflow pins to
github/codeql-action@v4.36.2. - Update release automation actions (
softprops/action-gh-release@v3.0.0,peter-evans/create-pull-request@v8.1.1) and the composite setup action (pnpm/action-setup@v6.0.8,actions/setup-node@v6.4.0).
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/tag-version.yml | Bumps actions/checkout pin used for tagging after version bump merges. |
| .github/workflows/release.yml | Bumps actions/checkout and softprops/action-gh-release pins used during manual releases. |
| .github/workflows/copilot-setup-steps.yml | Bumps actions/checkout pin used by the Copilot setup workflow. |
| .github/workflows/codeql.yml | Bumps actions/checkout and CodeQL action pins for security scanning. |
| .github/workflows/ci.yml | Bumps actions/checkout pins across CI jobs. |
| .github/workflows/auto-version-bump.yml | Bumps actions/checkout and peter-evans/create-pull-request pins for automated version bump PRs. |
| .github/actions/setup/action.yml | Updates pnpm + Node setup action pins used by workflows. |
Comment on lines
61
to
+62
| - name: Create Pull Request | ||
| uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5 | ||
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 |
Comment on lines
87
to
89
| - name: Create GitHub Release | ||
| uses: softprops/action-gh-release@e7a8f85e1c67a31e6ed99a94b41bd0b71bbee6b8 # v2.2.0 | ||
| uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 | ||
| with: |
Comment on lines
31
to
33
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0 | ||
| uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 | ||
| with: |
Comment on lines
7
to
9
| - name: Setup pnpm | ||
| uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2 # v4.0.0 | ||
| uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 | ||
| with: |
Comment on lines
12
to
15
| - name: Setup Node.js 22.14.0 | ||
| uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 | ||
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | ||
| with: | ||
| node-version-file: '.nvmrc' |
bestdan
changed the title
action-setup now resolves the version from package.json's packageManager field (pnpm@9.0.0); the explicit version input duplicated it.
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/github_actions/github-actions-ac25b41920
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refreshes the github-actions dependencies to current stable releases, each pinned to the full commit SHA of its tag (verified against upstream) so the ref cannot be moved out from under us. All selected versions are >7 days old to avoid freshly-published compromised releases.
Action bumps
df4cb1c5f6978f8aad20db4309330e279bb48b55a0Security review (SHA-level)
github/codeql-actionv3.28.0 (currentmain) is in range of CVE-2025-24362 (token leak in debug artifacts, fixed in 3.28.3); v4.36.2 clears it. No advisories for the other five.action-gh-releasehad a SHA that was actually v2.6.1 while the comment claimed v2.2.0. Comments now match SHAs everywhere.All CI checks pass.