Skip to content

Bump the version-updates group across 1 directory with 8 updates#489

Merged
marcransome merged 1 commit into
mainfrom
dependabot/github_actions/version-updates-69136c0070
Jul 22, 2026
Merged

Bump the version-updates group across 1 directory with 8 updates#489
marcransome merged 1 commit into
mainfrom
dependabot/github_actions/version-updates-69136c0070

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the version-updates group with 8 updates in the / directory:

Package From To
actions/checkout 7.0.0 7.0.1
github/codeql-action/init 4.37.1 4.37.3
github/codeql-action/analyze 4.37.1 4.37.3
fish-shop/install-fish-shell 2.1.21 2.1.22
fish-shop/indent-check 2.2.112 2.2.113
fish-shop/syntax-check 2.2.110 2.2.111
fish-shop/install-plugin 2.3.114 2.3.115
fish-shop/run-fishtape-tests 2.3.114 2.3.115

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates github/codeql-action/init from 4.37.1 to 4.37.3

Release notes

Sourced from github/codeql-action/init's releases.

v4.37.3

No user facing changes.

v4.37.2

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007
Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

  • Update default CodeQL bundle version to 2.26.0. #3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

  • Cache CodeQL CLI version information across Actions steps. #3943
  • Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
  • Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
  • Add support for SHA-256 Git object IDs. #3893
  • Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

  • We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

... (truncated)

Commits
  • e4fba86 Merge pull request #4031 from github/update-v4.37.3-72f6a9da0
  • fb50ab5 Update changelog for v4.37.3
  • 72f6a9d Merge pull request #4030 from github/mbg/fix/no-proxy
  • 3b5ee58 Use default request options instead of undefined
  • bfb6be4 Merge pull request #4028 from github/mergeback/v4.37.2-to-main-e0647621
  • 526ab84 Rebuild
  • d6217b9 Update changelog and version after v4.37.2
  • e064762 Merge pull request #4027 from github/update-v4.37.2-385bcdc5a
  • e0faed8 Add a couple of change notes
  • 73aad0e Update changelog for v4.37.2
  • Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.1 to 4.37.3

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.37.3

No user facing changes.

v4.37.2

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007
Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

  • Update default CodeQL bundle version to 2.26.0. #3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

  • Cache CodeQL CLI version information across Actions steps. #3943
  • Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
  • Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
  • Add support for SHA-256 Git object IDs. #3893
  • Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

  • We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

... (truncated)

Commits
  • e4fba86 Merge pull request #4031 from github/update-v4.37.3-72f6a9da0
  • fb50ab5 Update changelog for v4.37.3
  • 72f6a9d Merge pull request #4030 from github/mbg/fix/no-proxy
  • 3b5ee58 Use default request options instead of undefined
  • bfb6be4 Merge pull request #4028 from github/mergeback/v4.37.2-to-main-e0647621
  • 526ab84 Rebuild
  • d6217b9 Update changelog and version after v4.37.2
  • e064762 Merge pull request #4027 from github/update-v4.37.2-385bcdc5a
  • e0faed8 Add a couple of change notes
  • 73aad0e Update changelog for v4.37.2
  • Additional commits viewable in compare view

Updates fish-shop/install-fish-shell from 2.1.21 to 2.1.22

Release notes

Sourced from fish-shop/install-fish-shell's releases.

v2.1.22

What's Changed

Full Changelog: fish-shop/install-fish-shell@v2.1.21...v2.1.22

Commits
  • d220f23 Merge pull request #311 from fish-shop/dependabot/github_actions/version-upda...
  • 726a966 Bump the version-updates group across 1 directory with 7 updates
  • See full diff in compare view

Updates fish-shop/indent-check from 2.2.112 to 2.2.113

Release notes

Sourced from fish-shop/indent-check's releases.

v2.2.113

What's Changed

Full Changelog: fish-shop/indent-check@v2.2.112...v2.2.113

Commits
  • e1aeeff Merge pull request #298 from fish-shop/dependabot/github_actions/version-upda...
  • 4f92e5a Bump the version-updates group across 1 directory with 8 updates
  • See full diff in compare view

Updates fish-shop/syntax-check from 2.2.110 to 2.2.111

Release notes

Sourced from fish-shop/syntax-check's releases.

v2.2.111

What's Changed

Full Changelog: fish-shop/syntax-check@v2.2.110...v2.2.111

Commits
  • af833a7 Merge pull request #383 from fish-shop/dependabot/github_actions/version-upda...
  • a608ddf Bump the version-updates group across 1 directory with 8 updates
  • See full diff in compare view

Updates fish-shop/install-plugin from 2.3.114 to 2.3.115

Release notes

Sourced from fish-shop/install-plugin's releases.

v2.3.115

What's Changed

Full Changelog: fish-shop/install-plugin@v2.3.114...v2.3.115

Commits
  • ca69e98 Merge pull request #422 from fish-shop/dependabot/github_actions/version-upda...
  • b04ddc7 Bump the version-updates group across 1 directory with 9 updates
  • See full diff in compare view

Updates fish-shop/run-fishtape-tests from 2.3.114 to 2.3.115

Release notes

Sourced from fish-shop/run-fishtape-tests's releases.

v2.3.115

What's Changed

Full Changelog: fish-shop/run-fishtape-tests@v2.3.114...v2.3.115

Commits
  • 234e19d Merge pull request #409 from fish-shop/dependabot/github_actions/version-upda...
  • e1ca5eb Bump the version-updates group across 1 directory with 9 updates
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the version-updates group across 1 directory with 8 updates
252a156 
Bumps the version-updates group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.1` | `4.37.3` |
| [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.1` | `4.37.3` |
| [fish-shop/install-fish-shell](https://github.com/fish-shop/install-fish-shell) | `2.1.21` | `2.1.22` |
| [fish-shop/indent-check](https://github.com/fish-shop/indent-check) | `2.2.112` | `2.2.113` |
| [fish-shop/syntax-check](https://github.com/fish-shop/syntax-check) | `2.2.110` | `2.2.111` |
| [fish-shop/install-plugin](https://github.com/fish-shop/install-plugin) | `2.3.114` | `2.3.115` |
| [fish-shop/run-fishtape-tests](https://github.com/fish-shop/run-fishtape-tests) | `2.3.114` | `2.3.115` |



Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)

Updates `github/codeql-action/init` from 4.37.1 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@7188fc3...e4fba86)

Updates `github/codeql-action/analyze` from 4.37.1 to 4.37.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@7188fc3...e4fba86)

Updates `fish-shop/install-fish-shell` from 2.1.21 to 2.1.22
- [Release notes](https://github.com/fish-shop/install-fish-shell/releases)
- [Commits](fish-shop/install-fish-shell@e83b4f8...d220f23)

Updates `fish-shop/indent-check` from 2.2.112 to 2.2.113
- [Release notes](https://github.com/fish-shop/indent-check/releases)
- [Commits](fish-shop/indent-check@ee3ad08...e1aeeff)

Updates `fish-shop/syntax-check` from 2.2.110 to 2.2.111
- [Release notes](https://github.com/fish-shop/syntax-check/releases)
- [Commits](fish-shop/syntax-check@3d50035...af833a7)

Updates `fish-shop/install-plugin` from 2.3.114 to 2.3.115
- [Release notes](https://github.com/fish-shop/install-plugin/releases)
- [Commits](fish-shop/install-plugin@1ca93fe...ca69e98)

Updates `fish-shop/run-fishtape-tests` from 2.3.114 to 2.3.115
- [Release notes](https://github.com/fish-shop/run-fishtape-tests/releases)
- [Commits](fish-shop/run-fishtape-tests@d3f44af...234e19d)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: version-updates
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: version-updates
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: version-updates
- dependency-name: fish-shop/install-fish-shell
  dependency-version: 2.1.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: version-updates
- dependency-name: fish-shop/indent-check
  dependency-version: 2.2.113
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: version-updates
- dependency-name: fish-shop/syntax-check
  dependency-version: 2.2.111
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: version-updates
- dependency-name: fish-shop/install-plugin
  dependency-version: 2.3.115
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: version-updates
- dependency-name: fish-shop/run-fishtape-tests
  dependency-version: 2.3.115
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: version-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from marcransome as a code owner July 22, 2026 14:24
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 22, 2026
@github-actions

github-actions Bot commented Jul 22, 2026

Copy link
Copy Markdown

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 4 package(s) with unknown licenses.
See the Details below.

License Issues

.github/workflows/test.yml

PackageVersionLicenseIssue Type
fish-shop/indent-checke1aeeffb6d8e4a04cc1eed5a0eb85444f6531fa5NullUnknown License
fish-shop/install-pluginca69e981845cbf4848399ae117f045f6313addc0NullUnknown License
fish-shop/run-fishtape-tests234e19d329994e9384019717d42fc2b92154bc00NullUnknown License
fish-shop/syntax-checkaf833a75d5af7ba761fc1ed8e8c4f6a6a2658a99NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
actions/actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 🟢 6.9
Details
CheckScoreReason
Maintained🟢 1024 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
SAST🟢 10SAST tool is run on all commits
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
actions/actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 🟢 6.9
Details
CheckScoreReason
Maintained🟢 1024 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
SAST🟢 10SAST tool is run on all commits
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
actions/fish-shop/indent-check e1aeeffb6d8e4a04cc1eed5a0eb85444f6531fa5 🟢 8.2
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/1 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1022 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Fuzzing⚠️ 0project is not fuzzed
Contributors🟢 10project has 3 contributing companies or organizations -- score normalized to 10
CI-Tests🟢 1015 out of 15 merged PRs checked by a CI test -- score normalized to 10
actions/fish-shop/install-fish-shell d220f233dfcd74ca99891ffad9c4dd78a8137545 🟢 8.2
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy🟢 10security policy file detected
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1022 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Pinned-Dependencies🟢 10all dependencies are pinned
Code-Review⚠️ 0Found 0/1 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
License🟢 10license file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 10SAST tool is run on all commits
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Contributors🟢 10project has 3 contributing companies or organizations -- score normalized to 10
CI-Tests🟢 1015 out of 15 merged PRs checked by a CI test -- score normalized to 10
actions/fish-shop/install-plugin ca69e981845cbf4848399ae117f045f6313addc0 🟢 8.2
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1022 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
Code-Review⚠️ 0Found 0/1 approved changesets -- score normalized to 0
Security-Policy🟢 10security policy file detected
Dependency-Update-Tool🟢 10update tool detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
License🟢 10license file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
SAST🟢 10SAST tool is run on all commits
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Contributors🟢 10project has 3 contributing companies or organizations -- score normalized to 10
CI-Tests🟢 1015 out of 15 merged PRs checked by a CI test -- score normalized to 10
actions/fish-shop/run-fishtape-tests 234e19d329994e9384019717d42fc2b92154bc00 🟢 8.2
Details
CheckScoreReason
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1022 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 0/1 approved changesets -- score normalized to 0
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies🟢 10all dependencies are pinned
Vulnerabilities🟢 100 existing vulnerabilities detected
License🟢 10license file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
SAST🟢 10SAST tool is run on all commits
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Contributors🟢 10project has 3 contributing companies or organizations -- score normalized to 10
CI-Tests🟢 1015 out of 15 merged PRs checked by a CI test -- score normalized to 10
actions/fish-shop/syntax-check af833a75d5af7ba761fc1ed8e8c4f6a6a2658a99 🟢 8.2
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/1 approved changesets -- score normalized to 0
Maintained🟢 1022 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies🟢 10all dependencies are pinned
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Packaging⚠️ -1packaging workflow not detected
Vulnerabilities🟢 100 existing vulnerabilities detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
SAST🟢 10SAST tool is run on all commits
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Contributors🟢 10project has 3 contributing companies or organizations -- score normalized to 10
CI-Tests🟢 1015 out of 15 merged PRs checked by a CI test -- score normalized to 10

Scanned Files

  • .github/workflows/markdown-links.yml
  • .github/workflows/test.yml

@marcransome
marcransome merged commit 1ea08b7 into main Jul 22, 2026
13 checks passed
@marcransome
marcransome deleted the dependabot/github_actions/version-updates-69136c0070 branch July 22, 2026 18:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marcransome marcransome marcransome approved these changes

Assignees

@marcransome marcransome

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@marcransome