Skip to content

🚨 Update github actions (main) (major) #1679

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

🚨 Update github actions (main) (major) #1679

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ jobs:
disable-telemetry: true

- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/pre-merge-ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,10 +45,10 @@ jobs:
disable-telemetry: true

- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Setup Go environment
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: true
Expand All @@ -74,7 +74,7 @@ jobs:
# run: ./hack/validate-acceptable-bundles.sh

- name: Upload test coverage report
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0

@fullsend-ai-review fullsend-ai-review Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] api-contract

codecov/codecov-action is updated from v5.5.2 to v7.0.0, skipping v6. The use_oidc parameter may no longer be recognized in v7. Because fail_ci_if_error: false is set, a failure would be silent.

Suggested fix: Verify against codecov-action v7 docs that use_oidc is still supported. Consider temporarily setting fail_ci_if_error: true.

@fullsend-ai-review fullsend-ai-review Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] supply-chain

codecov/codecov-action is bumped from v5.5.2 to v7.0.0, skipping v6. The pinned commit hash should be verified against the upstream v7.0.0 tag. This action runs with id-token: write, so a compromised version could exfiltrate an OIDC token.

Suggested fix: Verify the commit hash matches the v7.0.0 tag: git ls-remote https://github.com/codecov/codecov-action refs/tags/v7.0.0

@fullsend-ai-review fullsend-ai-review Bot Jun 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] edge-case

codecov/codecov-action is being bumped from v5.5.2 to v7.0.0, skipping the entire v6 major release line. The workflow uses use_oidc: true for authentication. The compatibility of this parameter with v7 should be verified. Note that fail_ci_if_error: false means a broken upload would be silent.

Suggested fix: Run the pre-merge CI workflow on this branch to confirm coverage upload succeeds before merging. Check codecov-action v7 documentation for any changes to the use_oidc parameter.

@fullsend-ai-review fullsend-ai-review Bot Jun 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] supply-chain integrity

codecov/codecov-action is being bumped from v5.5.2 to v7.0.0, a two-major-version jump. This action receives an OIDC token (use_oidc: true) which makes it security-sensitive. The SHA fb8b3582c8e4def4969c97caa2f19720cb33a72f should be verified against the upstream repository.

Suggested fix: Verify the SHA matches the v7.0.0 tag at https://github.com/codecov/codecov-action. Review the changelog for v6 and v7 breaking changes, especially around OIDC token handling.

if: always()
with:
use_oidc: true

@fullsend-ai-review fullsend-ai-review Bot Jun 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] api-contract

The use_oidc input is used with codecov/codecov-action, but this PR jumps from v5.5.2 to v7.0.0, skipping v6 entirely. In codecov-action v7, OIDC became the default authentication method and the use_oidc input may have been removed. While GitHub Actions silently ignores unknown inputs, the dead configuration is misleading and the two-major-version skip accumulates breaking changes that should be verified.

Suggested fix: Review codecov-action v6 and v7 changelogs. Remove use_oidc: true if it is no longer a recognized input in v7. Confirm OIDC works by default with the existing id-token: write permission.

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/push-bundles.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,14 +42,14 @@ jobs:
disable-telemetry: true

- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
# So we can see in which commit a bundle's content was
# most recently updated
fetch-depth: 0

- name: Setup Go environment
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version-file: go.mod
cache: true
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ jobs:
disable-telemetry: true

- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0

Expand Down Expand Up @@ -146,7 +146,7 @@ jobs:
disable-telemetry: true

- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0

Expand All @@ -161,7 +161,7 @@ jobs:
git push -f --tags

- name: Create a release
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
with:
name: ${{ needs.get_info.outputs.next_version }}
tag_name: ${{ needs.get_info.outputs.next_version }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/scorecards.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ jobs:
disable-telemetry: true

- name: "Checkout code"
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false

Expand All @@ -81,7 +81,7 @@ jobs:
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
# format to the repository Actions tab.
- name: "Upload artifact"
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

@fullsend-ai-review fullsend-ai-review Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[info] api-contract

actions/upload-artifact v6.0.0 to v7.0.1. Inputs used are basic and no download-artifact usage exists in the repo. Minimal risk.

@fullsend-ai-review fullsend-ai-review Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[info] supply-chain

actions/upload-artifact is a first-party GitHub action. Supply-chain risk is minimal for hash-pinned first-party actions.

@fullsend-ai-review fullsend-ai-review Bot Jun 18, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[info] permission-reduction

actions/upload-artifact upgraded from v6.0.0 to v7.0.1 with pinned SHA. The existing usage pattern remains compatible.

with:
name: SARIF file
path: results.sarif
Expand Down
Loading