chore(deps): update github workflows - #6733
Conversation
Codecov Results 📊✅ 103984 passed | ⏭️ 6677 skipped | Total: 110661 | Pass Rate: 93.97% | Execution Time: 359m 60s 📊 Comparison with Base Branch
✨ No test changes detected All tests are passing successfully. ✅ Patch coverage is 100.00%. Project has 2479 uncovered lines. Coverage diff@@ Coverage Diff @@
## main #PR +/-##
==========================================
+ Coverage 90.14% 90.14% —%
==========================================
Files 193 193 —
Lines 25147 25147 —
Branches 9136 9136 —
==========================================
+ Hits 22669 22668 -1
- Misses 2478 2479 +1
- Partials 1431 1433 +2Generated by Codecov Action |
f723b07 to
ab7796a
Compare
4ff0133 to
ae76386
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
64fb4a7 to
f8ebb7b
Compare
![sentry-warden[bot]](https://avatars.githubusercontent.com/in/2755838?s=60&v=4){kind=small}
6bc2f74 to
1dcbc62
Compare
1dcbc62 to
58362ff
Compare
347bca1 to
3f9c730
Compare
3f9c730 to
c2a9ecc
Compare
c2a9ecc to
c39c69d
Compare
c39c69d to
f67fb98
Compare
1a1b6cf to
d88586b
Compare
d88586b to
b59bcb4
Compare
| enable-cache: false | ||
| - name: Install Java | ||
| uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 | ||
| uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5 |
There was a problem hiding this comment.
Invalid setup-java action digest
High Severity
The pinned actions/setup-java digest b6effb05e454b25005698d916606bdc6ffcbf961 does not match the digest this PR documents (03ad4de0992f5dab5e18fcb136590ce7c4a0ac95) and does not resolve to a known commit on actions/setup-java. Jobs that install Java via this pin, including the tasks integration workflow, will fail when GitHub Actions cannot fetch the action.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit b59bcb4. Configure here.
b59bcb4 to
7202e2b
Compare
7202e2b to
f82506c
Compare
f82506c to
b924259
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
There are 2 total unresolved issues (including 1 from previous review).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit b924259. Configure here.
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | ||
| uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 |
There was a problem hiding this comment.
Template drift reverts codecov action bump
Medium Severity
.github/workflows/test.yml is auto-generated from test_orchestrator.jinja, and the getsentry/codecov-action digest was bumped only in the generated file. The template still pins the previous digest, so the next run of scripts/generate-test-files.sh (triggered weekly by update-tox.yml) will silently revert this update while other pins stay current.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit b924259. Configure here.
b924259 to
2343487
Compare
2e7a2aa to
477df02
Compare
477df02 to
69ed102
Compare
| app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }} | ||
| private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }} | ||
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
actions/checkout update references non-existent major version v7.0.1
The PR claims to update actions/checkout to v7.0.1, but the official actions/checkout action has never published v6 or v7 releases. The pinned commit hash may not correspond to a legitimate, trusted release, creating a supply chain risk for the release workflow which passes a GitHub App token to this action. Can you verify the commit hash 3d3c42e5aac5ba805825da76410c181273ba90b1 belongs to the official actions/checkout repository and is from a trusted source?
Evidence
- The diff updates the
actions/checkoutSHA fromdf4cb1c069e1874edd31b4311f1884172cec0e10(commentedv6.0.3) to3d3c42e5aac5ba805825da76410c181273ba90b1(commentedv7.0.1). - The PR body table explicitly lists this as a major update from
v6.0.3tov7.0.1foractions/checkout. - The official
actions/checkoutrepository does not have v6 or v7 releases, making the version comments suspect and implying the commit hash could point to unofficial or compromised code. - The release workflow passes
${{ steps.token.outputs.token }}directly intoactions/checkout, so a compromised action at that SHA could exfiltrate the generated GitHub App token during release runs.
Identified by Warden · code-review · FLZ-DTQ
This PR contains the following updates:
v6.0.3→v7.0.1v6.0.3→v7.0.1be666c2→b6effb0be666c2→b6effb0v6.4.0→v7.0.0v6→v7v1.0.142→v1.0.190v8.2.0→v9.0.0v8.2.0→v9.0.048236a7→d0aa91bd90e69c→66554aav2.26.9→2.30.16143e76→cd1e82917-alpine→18-alpine17-alpine→18-alpine20→24Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v7Compare Source
v6.1.0Compare Source
actions/setup-node (actions/setup-node)
v7.0.0Compare Source
What's Changed
Enhancements:
Bug fixes:
mirrorTokeningetManifestif it's provided by @deiga in #1548Documentation updates:
Dependency update:
New Contributors
Full Changelog: actions/setup-node@v6...v7.0.0
v7Compare Source
v6.5.0Compare Source
What's Changed
Full Changelog: actions/setup-node@v6.4.0...v6.5.0
actions/setup-python (actions/setup-python)
v7.0.0Compare Source
v7Compare Source
anthropics/claude-code-action (anthropics/claude-code-action)
v1.0.190Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.190
v1.0.189Compare Source
v1.0.188Compare Source
v1.0.187Compare Source
What's Changed
Full Changelog: anthropics/claude-code-action@v1...v1.0.187
v1.0.186Compare Source
v1.0.185Compare Source
What's Changed
Full Changelog: anthropics/claude-code-action@v1...v1.0.185
v1.0.184Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.184
v1.0.183Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.183
v1.0.182Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.182
v1.0.181Compare Source
v1.0.180Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.180
v1.0.179Compare Source
v1.0.178Compare Source
v1.0.177Compare Source
v1.0.176Compare Source
v1.0.175Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.175
v1.0.174Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.174
v1.0.173Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.173
v1.0.172Compare Source
What's Changed
Full Changelog: anthropics/claude-code-action@v1...v1.0.172
v1.0.171Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.171
v1.0.170Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.170
v1.0.169Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.169
v1.0.168Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.168
v1.0.167Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.167
v1.0.166Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.166
v1.0.165Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.165
v1.0.164Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.164
v1.0.163Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.163
v1.0.162Compare Source
v1.0.161Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.161
v1.0.160Compare Source
v1.0.159Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.159
v1.0.158Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.158
v1.0.157Compare Source
v1.0.156Compare Source
v1.0.155Compare Source
v1.0.154Compare Source
v1.0.153Compare Source
v1.0.152Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.152
v1.0.151Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.151
v1.0.150Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.150
v1.0.149Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.149
v1.0.148Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.148
v1.0.147Compare Source
What's Changed
Full Changelog: anthropics/claude-code-action@v1...v1.0.147
v1.0.146Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.146
v1.0.145Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.145
v1.0.144Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.144
v1.0.143Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.143
astral-sh/setup-uv (astral-sh/setup-uv)
v9.0.0Compare Source
v8.3.2Compare Source
v8.3.1Compare Source
v8.3.0Compare Source
getsentry/craft (getsentry/craft)
v2.30.1Compare Source
Bug Fixes 🐛
v2.30.0Compare Source
New Features ✨
v2.29.0Compare Source
New Features ✨
Bug Fixes 🐛
Documentation 📚
v2.28.0Compare Source
New Features ✨
v2.27.2Compare Source
Bug Fixes 🐛
v2.27.1Compare Source
Bug Fixes 🐛
v2.27.0Compare Source
New Features ✨
Bug Fixes 🐛
Documentation 📚
Internal Changes 🔧
Deps Dev
Other
v2.26.14Compare Source
Bug Fixes 🐛
Deps
v2.26.13Compare Source
Internal Changes 🔧
v2.26.12Compare Source
Bug Fixes 🐛
v2.26.11Compare Source
Bug Fixes 🐛
Internal Changes 🔧
v2.26.10Compare Source
Bug Fixes 🐛
actions/node-versions (node)
v24.19.0: 24.19.0Compare Source
Node.js 24.19.0
v24.18.1: 24.18.1Compare Source
Node.js 24.18.1
v24.18.0: 24.18.0Compare Source
Node.js 24.18.0
v24.17.0: 24.17.0Compare Source
Node.js 24.17.0
v24.16.0: 24.16.0Compare Source
Node.js 24.16.0
v24.15.0: 24.15.0Compare Source
Node.js 24.15.0
v24.14.1: 24.14.1Compare Source
Node.js 24.14.1
v24.14.0: 24.14.0Compare Source
Node.js 24.14.0
v24.13.1: 24.13.1Compare Source
Node.js 24.13.1
v24.13.0: 24.13.0Compare Source
Node.js 24.13.0
v24.12.0: 24.12.0Compare Source
Node.js 24.12.0
v24.11.1: 24.11.1Compare Source
Node.js 24.11.1
v24.11.0: 24.11.0Compare Source
Node.js 24.11.0
v24.10.0: 24.10.0Compare Source
Node.js 24.10.0
v24.9.0: 24.9.0Compare Source
Node.js 24.9.0
v24.8.0: 24.8.0Compare Source
Node.js 24.8.0
v24.7.0: 24.7.0Compare Source
Node.js 24.7.0
v24.6.0: 24.6.0Compare Source
Node.js 24.6.0
v24.5.0: 24.5.0Compare Source
Node.js 24.5.0
v24.4.1: 24.4.1Compare Source
Node.js 24.4.1
v24.4.0: 24.4.0Compare Source
Node.js 24.4.0
v24.3.0: 24.3.0Compare Source
Node.js 24.3.0
v24.2.0: 24.2.0Compare Source
Node.js 24.2.0
v24.1.0: 24.1.0Compare Source
Node.js 24.1.0
v24.0.2: 24.0.2Compare Source
Node.js 24.0.2
v24.0.1: 24.0.1Compare Source
Node.js 24.0.1
v24.0.0: 24.0.0Compare Source
Node.js 24.0.0
v22.23.2: 22.23.2Compare Source
Node.js 22.23.2
v22.23.1: 22.23.1Compare Source
Node.js 22.23.1
v22.23.0: 22.23.0Compare Source
Node.js 22.23.0
v22.22.3: 22.22.3Compare Source
Node.js 22.22.3
v22.22.2: 22.22.2Compare Source
Node.js 22.22.2
v22.22.1: 22.22.1Compare Source
Node.js 22.22.1
v22.22.0: 22.22.0Compare Source
Node.js 22.22.0
v22.21.1: 22.21.1Compare Source
Node.js 22.21.1
v22.21.0: 22.21.0Compare Source
Node.js 22.21.0
v22.20.0: 22.20.0Compare Source
Node.js 22.20.0
v22.19.0: 22.19.0Compare Source
Node.js 22.19.0
v22.18.0: 22.18.0Compare Source
Node.js 22.18.0
v22.17.1: 22.17.1Compare Source
Node.js 22.17.1
v22.17.0: 22.17.0Compare Source
Node.js 22.17.0
v22.16.0: 22.16.0Compare Source
Node.js 22.16.0
v22.15.1: 22.15.1Compare Source
Node.js 22.15.1
v22.15.0: 22.15.0Compare Source
Node.js 22.15.0
v22.14.0: 22.14.0Compare Source
Node.js 22.14.0
v22.13.1: 22.13.1Compare Source
Node.js 22.13.1
v22.13.0: 22.13.0Compare Source
Node.js 22.13.0
v22.12.0: 22.12.0Compare Source
Node.js 22.12.0
v22.11.0: 22.11.0Compare Source
Node.js 22.11.0
v22.10.0: 22.10.0Compare Source
Node.js 22.10.0
v22.9.0: 22.9.0Compare Source
Node.js 22.9.0
v22.8.0: 22.8.0Compare Source
Node.js 22.8.0
v22.7.0: 22.7.0Compare Source
Node.js 22.7.0
[
v22.6.0](https://redirect.github.com/actions/node-versions/releasesConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.