[Sync] Update project files from source repository (f7c6655) - #134
Merged
mrz1836 merged 1 commit intoJun 3, 2026
Merged
Conversation
mrz1836
added
automated-sync
|
There was a problem hiding this comment.
Pull request overview
This sync PR updates pinned GitHub Actions dependencies across the repository’s CI/security workflows to keep the automation toolchain current and consistent.
Changes:
- Bump
actions/checkoutpins from v6.0.2 to v6.0.3 across workflows and the warm-cache composite action. - Update
GOVULNCHECK_GO_VERSIONfrom1.26.3to1.26.4for vulnerability scanning. - Update additional security tooling pins in workflows (notably
github/codeql-actionto v4.36.1 andgitleaks/gitleaks-actionto v3.0.0).
Reviewed changes
Copilot reviewed 21 out of 21 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/sync-labels.yml | Bumps pinned actions/checkout SHA to v6.0.3. |
| .github/workflows/stale-check.yml | Bumps pinned actions/checkout SHA to v6.0.3. |
| .github/workflows/scorecard.yml | Bumps actions/checkout to v6.0.3 and codeql-action/upload-sarif to v4.36.1. |
| .github/workflows/pull-request-management.yml | Bumps pinned actions/checkout SHA (inline version comment needs to match). |
| .github/workflows/fortress-warm-cache.yml | Bumps pinned actions/checkout SHA to v6.0.3. |
| .github/workflows/fortress-test-suite.yml | Bumps pinned actions/checkout SHA to v6.0.3. |
| .github/workflows/fortress-test-matrix.yml | Bumps pinned actions/checkout SHA to v6.0.3. |
| .github/workflows/fortress-test-fuzz.yml | Bumps pinned actions/checkout SHA to v6.0.3. |
| .github/workflows/fortress-setup-config.yml | Bumps pinned actions/checkout SHA to v6.0.3. |
| .github/workflows/fortress-security-scans.yml | Bumps actions/checkout to v6.0.3 and gitleaks/gitleaks-action to v3.0.0 (note comment needs updating). |
| .github/workflows/fortress-release.yml | Bumps pinned actions/checkout SHA to v6.0.3. |
| .github/workflows/fortress-pre-commit.yml | Bumps pinned actions/checkout SHA to v6.0.3. |
| .github/workflows/fortress-coverage.yml | Bumps pinned actions/checkout SHA to v6.0.3. |
| .github/workflows/fortress-completion-report.yml | Bumps pinned actions/checkout SHA to v6.0.3. |
| .github/workflows/fortress-code-quality.yml | Bumps pinned actions/checkout SHA to v6.0.3. |
| .github/workflows/fortress-benchmarks.yml | Bumps pinned actions/checkout SHA to v6.0.3. |
| .github/workflows/dependabot-auto-merge.yml | Bumps pinned actions/checkout SHA to v6.0.3. |
| .github/workflows/codeql-analysis.yml | Bumps actions/checkout to v6.0.3 and github/codeql-action/* pins to v4.36.1. |
| .github/workflows/auto-merge-on-approval.yml | Bumps pinned actions/checkout SHA to v6.0.3. |
| .github/env/00-core.env | Updates GOVULNCHECK_GO_VERSION to 1.26.4. |
| .github/actions/warm-cache/action.yml | Bumps pinned actions/checkout SHA to v6.0.3 in the composite action. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # sonarcloud:S7631 — false positive: base-ref sparse checkout only (see NOSONAR below) | ||
| - name: 📥 Checkout base repo (sparse) | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 — NOSONAR(S7631): base-ref sparse checkout only; PR head is never checked out or executed | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.2 — NOSONAR(S7631): base-ref sparse checkout only; PR head is never checked out or executed |
| # sonarcloud:S7631 — false positive: base-ref sparse checkout only (see NOSONAR below) | ||
| - name: 📥 Checkout base repo (sparse) | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 — NOSONAR(S7631): base-ref sparse checkout only; PR head is never checked out or executed | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.2 — NOSONAR(S7631): base-ref sparse checkout only; PR head is never checked out or executed |
Comment on lines
500
to
+503
| # NOTE: gitleaks/gitleaks-action@v2.3.9 is the latest release and still uses Node.js 20. | ||
| # This will trigger a "Node.js 20 actions are deprecated" warning until the gitleaks | ||
| # maintainers release a new version with Node.js 24 support. Expected and harmless for now. | ||
| uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9 | ||
| uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 |
| # Initializes the CodeQL tools for scanning. | ||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0 | ||
| uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1 |
Member
Author
|
LGTM! |
github-actions
Bot
deleted the
chore/sync-files-bsv-blockchain-template-20260603-143303-f7c6655
branch
June 3, 2026 19:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Changed
actions/checkoutfrom commitde0fac2e4500dabe0009e67214ff5f5447ce83dd(v6.0.2) to commitdf4cb1c069e1874edd31b4311f1884172cec0e10(v6.0.3) across 21 workflow and action filesGOVULNCHECK_GO_VERSIONfrom1.26.3to1.26.4in.github/env/00-core.envWhy It Was Necessary
actions/checkoutaction up to date with the latest v6.0.3 release for security and bug fixesTesting Performed
actions/checkoutaction version works correctly in CI pipeline executionImpact / Risk