chore(deps): bump the github-actions group across 1 directory with 8 updates - #225
chore(deps): bump the github-actions group across 1 directory with 8 updates#225dependabot[bot] wants to merge 1 commit into
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| - name: Setup Supabase CLI | ||
| uses: supabase/setup-cli@v1 | ||
| uses: supabase/setup-cli@v2 |
| - name: Open auto-PR with regenerated inventory | ||
| if: steps.diff.outputs.changed == 'true' | ||
| uses: peter-evans/create-pull-request@v7 | ||
| uses: peter-evans/create-pull-request@v8 |
| with: | ||
| fetch-depth: 0 | ||
| - uses: gitleaks/gitleaks-action@v2 | ||
| - uses: gitleaks/gitleaks-action@v3 |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
🚩 CodeQL actions left at v4 while checkout was bumped to v6
In .github/workflows/codeql.yml, actions/checkout was updated to @v6 (line 66), but github/codeql-action/init@v4 (line 76) and github/codeql-action/analyze@v4 (line 88) were left unchanged. This could be intentional — the github/codeql-action may not yet have a v5+ release, or the CodeQL action may have compatibility constraints with its init/analyze pair. However, if this PR's intent is to bump all actions to their latest versions, this appears to be an incomplete transformation. The github/ namespace is GitHub-owned (first-party) so the SHA pinning rule doesn't apply.
(Refers to lines 76-88)
Was this helpful? React with 👍 or 👎 to provide feedback.
|
|
||
| - name: Setup Supabase CLI | ||
| uses: supabase/setup-cli@v1 | ||
| uses: supabase/setup-cli@v2 |
There was a problem hiding this comment.
🟡 Third-party action supabase/setup-cli not pinned to commit SHA
The .coderabbit.yaml path instruction for .github/workflows/**/*.yml mandates: "Pin every action to a full commit SHA (not @v4) for third-party actions." This PR updates supabase/setup-cli@v1 to supabase/setup-cli@v2 using a mutable version tag instead of a full commit SHA. This violates the repository's mandatory rule and reduces supply-chain security (a compromised tag could execute arbitrary code in CI).
Prompt for agents
The repository rule at .coderabbit.yaml under path_instructions for .github/workflows/**/*.yml requires third-party actions to be pinned to a full commit SHA. Replace `supabase/setup-cli@v2` with `supabase/setup-cli@<full-40-char-commit-sha>` where the SHA corresponds to the v2 release tag. You can find the SHA by running: git ls-remote https://github.com/supabase/setup-cli refs/tags/v2 or checking the releases page on GitHub.
Was this helpful? React with 👍 or 👎 to provide feedback.
| - name: Open auto-PR with regenerated inventory | ||
| if: steps.diff.outputs.changed == 'true' | ||
| uses: peter-evans/create-pull-request@v7 | ||
| uses: peter-evans/create-pull-request@v8 |
There was a problem hiding this comment.
🟡 Third-party action peter-evans/create-pull-request not pinned to commit SHA
The .coderabbit.yaml path instruction for .github/workflows/**/*.yml mandates: "Pin every action to a full commit SHA (not @v4) for third-party actions." This PR updates peter-evans/create-pull-request@v7 to peter-evans/create-pull-request@v8 using a mutable version tag instead of a full commit SHA. This violates the repository's mandatory rule and is a supply-chain security concern since this action has contents: write and pull-requests: write permissions.
Prompt for agents
The repository rule at .coderabbit.yaml under path_instructions for .github/workflows/**/*.yml requires third-party actions to be pinned to a full commit SHA. Replace `peter-evans/create-pull-request@v8` with `peter-evans/create-pull-request@<full-40-char-commit-sha>` where the SHA corresponds to the v8 release tag. This action runs with contents:write and pull-requests:write permissions, so SHA pinning is especially important. Find the SHA via: git ls-remote https://github.com/peter-evans/create-pull-request refs/tags/v8
Was this helpful? React with 👍 or 👎 to provide feedback.
| with: | ||
| fetch-depth: 0 | ||
| - uses: gitleaks/gitleaks-action@v2 | ||
| - uses: gitleaks/gitleaks-action@v3 |
There was a problem hiding this comment.
🟡 Third-party action gitleaks/gitleaks-action not pinned to commit SHA
The .coderabbit.yaml path instruction for .github/workflows/**/*.yml mandates: "Pin every action to a full commit SHA (not @v4) for third-party actions." This PR updates gitleaks/gitleaks-action@v2 to gitleaks/gitleaks-action@v3 using a mutable version tag instead of a full commit SHA. This violates the repository's mandatory rule. A compromised tag on this security-scanning action would be particularly dangerous since it could suppress secret detection.
Prompt for agents
The repository rule at .coderabbit.yaml under path_instructions for .github/workflows/**/*.yml requires third-party actions to be pinned to a full commit SHA. Replace `gitleaks/gitleaks-action@v3` with `gitleaks/gitleaks-action@<full-40-char-commit-sha>` where the SHA corresponds to the v3 release tag. Since gitleaks is a security scanner, SHA pinning is critical to prevent a supply-chain attack that could silently disable secret scanning. Find the SHA via: git ls-remote https://github.com/gitleaks/gitleaks-action refs/tags/v3
Was this helpful? React with 👍 or 👎 to provide feedback.
| - name: Upload Playwright report | ||
| if: always() | ||
| uses: actions/upload-artifact@v4 | ||
| uses: actions/upload-artifact@v7 |
There was a problem hiding this comment.
🚩 Version jumps skip multiple major versions (v4→v6, v4→v7)
Several actions jump multiple major versions: actions/checkout v4→v6 (skipping v5), actions/setup-node v4→v6 (skipping v5), actions/upload-artifact v4→v7 (skipping v5 and v6). Major version bumps in GitHub Actions often include breaking changes (e.g., upload-artifact v4 had significant API changes from v3). While I cannot verify whether these versions exist based on the repository context alone (the current date is June 2026, so they may well exist), the multi-version jumps deserve verification that no breaking input/output changes affect these workflows. For example, if upload-artifact@v7 changed the default compression or output format, the downstream consumers of playwright-report and feature-awareness-report artifacts may be affected.
Was this helpful? React with 👍 or 👎 to provide feedback.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
dependabot
Bot
changed the title
d4629b7 to
5bd04a4
Compare
5bd04a4 to
9cdae2f
Compare
…updates Bumps the github-actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4` | `6` | | [actions/setup-node](https://github.com/actions/setup-node) | `4` | `6` | | [supabase/setup-cli](https://github.com/supabase/setup-cli) | `1` | `2` | | [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `7` | `8` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` | | [actions/cache](https://github.com/actions/cache) | `4` | `5` | | [gitleaks/gitleaks-action](https://github.com/gitleaks/gitleaks-action) | `2` | `3` | | [actions/setup-python](https://github.com/actions/setup-python) | `5` | `6` | Updates `actions/checkout` from 4 to 6 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) Updates `actions/setup-node` from 4 to 6 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@v4...v6) Updates `supabase/setup-cli` from 1 to 2 - [Release notes](https://github.com/supabase/setup-cli/releases) - [Commits](supabase/setup-cli@v1...v2) Updates `peter-evans/create-pull-request` from 7 to 8 - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](peter-evans/create-pull-request@v7...v8) Updates `actions/upload-artifact` from 4 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v7) Updates `actions/cache` from 4 to 5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v4...v5) Updates `gitleaks/gitleaks-action` from 2 to 3 - [Release notes](https://github.com/gitleaks/gitleaks-action/releases) - [Commits](gitleaks/gitleaks-action@v2...v3) Updates `actions/setup-python` from 5 to 6 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v5...v6) --- updated-dependencies: - dependency-name: actions/cache dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-python dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: gitleaks/gitleaks-action dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: peter-evans/create-pull-request dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: supabase/setup-cli dependency-version: '2' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
9cdae2f to
7cada5f
Compare
|
Folded into #304 (feat/coachhelm-stats-roundup) — merged clean, combined gates green. Branch intact + reopenable. |
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
2 participants
Bumps the github-actions group with 8 updates in the / directory:
4646127847452356Updates
actions/checkoutfrom 4 to 6Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
df4cb1cUpdate changelog for v6.0.3 (#2446)1cce339Fix checkout init for SHA-256 repositories (#2439)900f221fix: expand merge commit SHA regex and add SHA-256 test cases (#2414)0c366fdUpdate changelog (#2357)de0fac2Fix tag handling: preserve annotations and explicit fetch-tags (#2356)064fe7fAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...8e8c483Clarify v6 README (#2328)033fa0dAdd worktree support for persist-credentials includeIf (#2327)c2d88d3Update all references from v5 and v4 to v6 (#2314)1af3b93update readme/changelog for v6 (#2311)Updates
actions/setup-nodefrom 4 to 6Release notes
Sourced from actions/setup-node's releases.
... (truncated)
Commits
48b55a0Update Node.js versions in versions.yml and bump package to v6.4.0 (#1533)ab72c7eUpgrade@actionsdependencies (#1525)53b8394Bump minimatch from 3.1.2 to 3.1.5 (#1498)54045abScope test lockfiles by package manager and update cache tests (#1495)c882bffReplace uuid with crypto.randomUUID() (#1378)774c1d6feat(node-version-file): support parsingdevEnginesfield (#1283)efcb663fix: remove hardcoded bearer (#1467)d02c89dFix npm audit issues (#1491)6044e13Docs: bump actions/checkout from v5 to v6 (#1468)8e49463Fix README typo (#1226)Updates
supabase/setup-clifrom 1 to 2Release notes
Sourced from supabase/setup-cli's releases.
... (truncated)
Commits
3c2f5e2fix: install Alpine runtime dependencies (#433)365cb46chore(deps-dev): bump the bun-minor-patch group across 1 directory with 4 upd...e0099b2chore(deps): bump the actions-minor-patch group across 1 directory with 2 upd...52a4467fix: setup-cli on Linux musl containers (#431)3095b00fix: authenticate latest release lookup (#430)a4d563afix: handle Supabase CLI v2.99 archives (#425)0abc813chore(deps): bump the bun-minor-patch group with 5 updates (#421)f55616efix: cache licensed action (#422)2df3f5fchore(deps): bump the actions-minor-patch group across 1 directory with 3 upd...df56b21chore(deps-dev): bump the bun-minor-patch group with 2 updates (#419)Updates
peter-evans/create-pull-requestfrom 7 to 8Release notes
Sourced from peter-evans/create-pull-request's releases.
... (truncated)
Commits
5f6978ffix: retry post-creation API calls on 422 eventual consistency errors (#4356)d32e88dbuild(deps-dev): bump the npm group with 3 updates (#4349)8170bccbuild(deps-dev): bump handlebars from 4.7.8 to 4.7.9 (#4344)0041819build(deps): bump picomatch (#4339)b993918build(deps-dev): bump flatted from 3.3.1 to 3.4.2 (#4334)36d7c84build(deps-dev): bump undici from 6.23.0 to 6.24.0 (#4328)a45d1fbbuild(deps): bump@tootallnate/onceand jest-environment-jsdom (#4323)3499eb6build(deps): bump the github-actions group with 2 updates (#4316)3f3b473build(deps): bump minimatch (#4311)6699836build(deps-dev): bump the npm group with 2 updates (#4305)Updates
actions/upload-artifactfrom 4 to 7Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
043fb46Merge pull request #797 from actions/yacaovsnc/update-dependency634250cInclude changes in typespec/ts-http-runtime 0.3.5e454baaReadme: bump all the example versions to v7 (#796)74fad66Update the readme with direct upload details (#795)bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)47309c9Merge pull request #754 from actions/Link-/add-proxy-integration-tests02a8460Add proxy integration testb7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEUpdates
actions/cachefrom 4 to 5Release notes
Sourced from actions/cache's releases.
... (truncated)
Changelog
Sourced from actions/cache's changelog.
... (truncated)
Commits
27d5ce7Merge pull request #1747 from actions/yacaovsnc/update-dependencyf280785licensed changes619aeb1npm run build generated dist filesbcf16c2Update ts-http-runtime to 0.3.56682284Merge pull request #1738 from actions/prepare-v5.0.4e340396Update RELEASES8a67110Add licenses1865903Update dependencies & patch security vulnerabilities5656298Merge pull request #1722 from RyPeck/patch-14e380d1Fix cache key in examples.md for bun.lockUpdates
gitleaks/gitleaks-actionfrom 2 to 3Release notes
Sourced from gitleaks/gitleaks-action's releases.
... (truncated)
Commits
e0c47f4chore: migrate to Node 24 runtime (v3)bf2dc8eMerge pull request #191 from Olexandr88/patch-1b71323bUpdate README.md9c66aa9Update README.md186c3feCreate FUNDING.ymlUpdates
actions/setup-pythonfrom 5 to 6Release notes
Sourced from actions/setup-python's releases.
... (truncated)
Commits
a309ff8Bump urllib3 from 2.6.0 to 2.6.3 in /tests/data (#1264)bfe8cc5Upgrade@actionsdependencies to Nod...Description has been truncated
Greptile Summary
Dependabot batch bump of 8 GitHub Actions across 7 workflow files, moving all actions to their latest major versions (primarily Node 24 runtimes). All upgrades are routine version increments with no usage-pattern changes required for this repository's existing workflow configurations.
actions/checkoutv4→v6,actions/setup-nodev4→v6,actions/setup-pythonv5→v6,actions/cachev4→v5,actions/upload-artifactv4→v7: Node 24 runtime upgrades; workflows that rely on npm caching already explicitly setcache: npm, so thesetup-node@v6breaking change (limiting automatic caching to npm) has no effect here.peter-evans/create-pull-requestv7→v8,supabase/setup-cliv1→v2,gitleaks/gitleaks-actionv2→v3: All confirmed backward-compatible for existing input/output usage;gitleaks-actionrelease notes explicitly state no changes to inputs, outputs, or behavior.Confidence Score: 5/5
All changes are automated dependency bumps to well-maintained official GitHub Actions; no logic, configuration, or secrets handling was modified.
Every updated action is a major-version Node 24 runtime migration with backward-compatible interfaces. Workflows that use caching all explicitly specify
cache: npm, making thesetup-node@v6auto-caching restriction irrelevant. The one Docker-container job (semgrep) was flagged in a prior review thread. All jobs run on GitHub-hosted runners where the runner version requirements are automatically satisfied.No files require special attention beyond what was already noted in prior review threads.
Important Files Changed
cache: npm), and supabase/setup-cli v1→v2; all on ubuntu-latest runners so no self-hosted runner constraints applycache: npmand github-hosted runnersFlowchart
%%{init: {'theme': 'neutral'}}%% flowchart TD A[PR Triggers] --> B[ci.yml] A --> C[codeql.yml] A --> D[docs-regen.yml] A --> E[feature-awareness.yml] A --> F[migration-lockdown.yml] A --> G[playwright.yml] A --> H[review-gate.yml] B --> B1["checkout@v6\nsetup-node@v6\nsupabase/setup-cli@v2"] C --> C1["checkout@v6"] D --> D1["checkout@v6\nsetup-node@v6\ncreate-pull-request@v8"] E --> E1["checkout@v6\nsetup-node@v6\nupload-artifact@v7"] F --> F1["checkout@v6"] G --> G1["checkout@v6\nsetup-node@v6\ncache@v5\nupload-artifact@v7"] H --> H1["checkout@v6\nsetup-node@v6\nsetup-python@v6\ngitleaks-action@v3"] style H1 fill:#ffe4b5,stroke:#f90Reviews (4): Last reviewed commit: "chore(deps): bump the github-actions gro..." | Re-trigger Greptile