chore(deps): Update GitHub Actions#173
Conversation
|
Warning Review limit reached
Next review available in: 44 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
📝 WalkthroughWalkthroughThe workflows update the integration-test PostgreSQL image digest, refresh pinned ChangesCI workflow updates
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related issues
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
99a9b64 to
567fd6d
Compare
williaby
changed the title
567fd6d to
f20c05d
Compare
williaby
changed the title
f20c05d to
f53a0dc
Compare
williaby
changed the title
f53a0dc to
36a148f
Compare
williaby
changed the title
36a148f to
1960715
Compare
williaby
changed the title
4a75d39 to
de0e21d
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 80: Add persist-credentials: false to every actions/checkout step in
.github/workflows/ci.yml at lines 80 and 128, and .github/workflows/reuse.yml at
lines 36-37 and 65-66; no other workflow changes are needed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 64817e59-132e-4e3f-b5ff-1e45b5995be9
📒 Files selected for processing (5)
.github/workflows/ci.yml.github/workflows/codeql.yml.github/workflows/renovate-auto-merge.yml.github/workflows/reuse.yml.github/workflows/scorecard.yml
🚧 Files skipped from review as they are similar to previous changes (2)
- .github/workflows/codeql.yml
- .github/workflows/scorecard.yml
| egress-policy: audit | ||
|
|
||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== ci.yml (around checkout sites) ==\n'
nl -ba .github/workflows/ci.yml | sed -n '60,150p'
printf '\n== reuse.yml (around checkout sites) ==\n'
nl -ba .github/workflows/reuse.yml | sed -n '1,120p'Repository: ByronWilliamsCPA/pp-security-master
Length of output: 251
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== ci.yml ==\n'
nl -ba .github/workflows/ci.yml | sed -n '1,220p'
printf '\n== reuse.yml ==\n'
nl -ba .github/workflows/reuse.yml | sed -n '1,220p'Repository: ByronWilliamsCPA/pp-security-master
Length of output: 227
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for f in .github/workflows/ci.yml .github/workflows/reuse.yml; do
echo "===== $f ====="
rg -n "actions/checkout|git |persist-credentials|fetch-depth|submodule|push|commit|tag" "$f" || true
doneRepository: ByronWilliamsCPA/pp-security-master
Length of output: 597
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
for path in [Path('.github/workflows/ci.yml'), Path('.github/workflows/reuse.yml')]:
print(f"===== {path} =====")
lines = path.read_text().splitlines()
# Print all lines with numbers, but keep output focused by marking the checkout lines and nearby context.
for i, line in enumerate(lines, start=1):
if any(k in line for k in ['actions/checkout', 'git ', 'persist-credentials', 'fetch-depth', 'submodule', 'push:', 'commit:', 'tag:']):
start = max(1, i - 6)
end = min(len(lines), i + 12)
print(f"\n--- context around line {i} ---")
for j in range(start, end + 1):
print(f"{j:4d}: {lines[j-1]}")
PYRepository: ByronWilliamsCPA/pp-security-master
Length of output: 4392
Disable persisted checkout credentials in these read-only jobs.
Add persist-credentials: false to each actions/checkout step; none of these jobs show a later Git operation that needs the token.
.github/workflows/ci.yml#L80.github/workflows/ci.yml#L128.github/workflows/reuse.yml#L36-L37.github/workflows/reuse.yml#L65-L66
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 80-80: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 2 files
.github/workflows/ci.yml#L80-L80(this comment).github/workflows/ci.yml#L128-L128.github/workflows/reuse.yml#L36-L37.github/workflows/reuse.yml#L65-L66
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 80, Add persist-credentials: false to every
actions/checkout step in .github/workflows/ci.yml at lines 80 and 128, and
.github/workflows/reuse.yml at lines 36-37 and 65-66; no other workflow changes
are needed.
Source: Linters/SAST tools
de0e21d to
a9509b7
Compare
a9509b7 to
b006a9f
Compare
1 participant
Summary
Why
Scheduled patch update, bug fixes and security patches with no API changes.
Changes
This PR contains the following updates:
9c091bb→3d3c42ev4.37.0→v4.37.322c89fe→3a82e1fWarning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Impact
Acceptance Criteria
Testing
Notes
Release Notes
github/codeql-action (github/codeql-action)
v4.37.3Compare Source
No user facing changes.
v4.37.2Compare Source
config-fileinput that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, theremote=prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023v4.37.1Compare Source
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.