Skip to content

chore(deps): update github-actions - #291

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions
Open

renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions

Conversation

@renovate

@renovate renovate Bot commented Sep 24, 2026 •

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
actions/create-github-app-token action minor v3.2.0 → v3.3.0
actions/create-github-app-token (changelog) action digest bcd2ba4 → 64ab729
anthropics/claude-code-action (changelog) action digest 8cf3482 → d5f7970
anthropics/claude-code-action action patch v1.0.233 → v1.0.272
astral-sh/setup-uv action minor v10.2.0 → v10.3.3
azure/setup-helm action minor v5.0.1 → v5.1.0
azure/setup-kubectl action minor v5.1.0 → v5.2.0
bats-core/bats-action action minor 4.0.0 → 4.1.0
docker/login-action action minor v4.6.0 → v4.8.0
ghcr.io/bridgecrewio/checkov docker minor 3.3.0 → 3.4.5
github/codeql-action action minor v4.38.1 → v4.39.3
openai/codex-action action minor v1.12 → v1.13
peter-evans/create-pull-request action patch v8.1.1 → v8.1.3
reviewdog/action-actionlint action minor v1.77.0 → v1.84.1
sigstore/cosign-installer action patch v4.1.2 → v4.1.3

Release Notes

actions/create-github-app-token

v3.3.0

Compare Source

Features
Bug Fixes
  • deps: bump nested undici from 6.24.0 to 6.29.0 (#​403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#​395) (a69c19d)
anthropics/claude-code-action

v1.0.272

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1.0.271...v1.0.272

v1.0.271

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.270...v1.0.271

v1.0.270

Compare Source

What's Changed

  • release: push tags with the release deploy key (enables tag-ruleset enforcement) by @​chrnorm in #​1650

New Contributors

Full Changelog: anthropics/claude-code-action@v1.0.269...v1.0.270

v1.0.269

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.268...v1.0.269

v1.0.268

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.267...v1.0.268

v1.0.267

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.266...v1.0.267

v1.0.266

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.265...v1.0.266

v1.0.265

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.264...v1.0.265

v1.0.264

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1.0.263...v1.0.264

v1.0.263

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.262...v1.0.263

v1.0.262

Compare Source

What's Changed
New Contributors

Full Changelog: anthropics/claude-code-action@v1.0.261...v1.0.262

v1.0.261

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.260...v1.0.261

v1.0.260

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1.0.259...v1.0.260

v1.0.259

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.258...v1.0.259

v1.0.258

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.257...v1.0.258

v1.0.257

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.256...v1.0.257

v1.0.256

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.255...v1.0.256

v1.0.255

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.254...v1.0.255

v1.0.254

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.253...v1.0.254

v1.0.253

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.252...v1.0.253

v1.0.252

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.251...v1.0.252

v1.0.251

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.250...v1.0.251

v1.0.250

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.249...v1.0.250

v1.0.249

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.248...v1.0.249

v1.0.248

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.247...v1.0.248

v1.0.247

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.246...v1.0.247

v1.0.246

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.245...v1.0.246

v1.0.245

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.244...v1.0.245

v1.0.244

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.243...v1.0.244

v1.0.243

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.242...v1.0.243

v1.0.242

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.241...v1.0.242

v1.0.241

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.240...v1.0.241

v1.0.240

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.239...v1.0.240

v1.0.239

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.238...v1.0.239

v1.0.238

Compare Source

What's Changed

New Contributors

Full Changelog: anthropics/claude-code-action@v1.0.237...v1.0.238

v1.0.237

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.236...v1.0.237

v1.0.236

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.235...v1.0.236

v1.0.235

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.234...v1.0.235

v1.0.234

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.233...v1.0.234

astral-sh/setup-uv

v10.3.3: 🌈 Use Astral mirror for version manifests with GitHub fallback

Compare Source

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable.
(Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v10.3.2: 🌈 update known checksums for 0.13.5

Compare Source

Changes

🧰 Maintenance

📚 Documentation

v10.3.1: 🌈 preserve cache error class names in save-cache bundle

Compare Source

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v10.3.0: 🌈 Add Python architecture selection

Compare Source

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

azure/setup-helm

v5.1.0

Compare Source

Added
Fixed
Security
Changed
azure/setup-kubectl

v5.2.0

Compare Source

Added
Fixed
Changed
Security
bats-core/bats-action

v4.1.0

Compare Source

What's Changed
🏕 Features
👒 Dependencies

Full Changelog: bats-core/bats-action@4.0.0...4.1.0

docker/login-action

v4.8.0

Compare Source

Full Changelog: docker/login-action@v4.7.0...v4.8.0

v4.7.0

Compare Source

Full Changelog: docker/login-action@v4.6.0...v4.7.0

bridgecrewio/checkov (ghcr.io/bridgecrewio/checkov)

v3.4.5

v3.4.4

Bug Fix
  • bicep: resolve references within the declaring file - #​7794

v3.4.3

Bug Fix
  • terraform: build userinfo test URLs dynamically - #​7776

v3.4.2

Bug Fix
  • general: harden network and credential handling defaults - #​7701
  • terraform: add optional allowlist for external module download sources - #​7758

v3.4.1

v3.4.0

  • no noteworthy changes

v3.3.30

Bug Fix

  • secrets: load platform-provided detectors in spawn-mode secrets … - #​7757

v3.3.29

Bug Fix
  • terraform: extend MySQL public access check to cover flexible server resources - #​7737

v3.3.28

Bug Fix
  • terraform: resolve graph edges for count/for_each indexed resource references - #​7736

v3.3.27

Bug Fix
  • secrets: detect paired AWS secret in bare CSV/delimited format - #​7734

v3.3.26

Bug Fix

  • terraform_plan: resolve for_each module calls in plan parser - #​7723

v3.3.24

v3.3.23

Bug Fix

  • sca: apply --skip-path regex and hidden-dir filtering to sca_package - #​7712

v3.3.22

v3.3.21

Bug Fix

  • terraform_json: handle HCL JSON array and single-dict block formats in parser - #​7707

v3.3.20

Bug Fix

  • terraform_plan: skip resources being removed from state ('forget' action) - #​7676

v3.3.19

Feature

  • terraform: add CKV_AWS_394 for unconstrained aws_availability_zones data source - #​7658

v3.3.18

v3.3.17

Bug Fix

  • general: honour scope.provider for platform-downloaded custom po… - #​7677

v3.3.16

Bug Fix

  • terraform: Added current Azure Terraform resources and taggable resources as of hashicorp/azurerm provider version 4.81 - #​7652

v3.3.15

Bug Fix

  • sca: match CVE suppressions case-insensitively - #​7659
  • sca: match CvesAccounts suppressions on unprefixed account ids - #​7660

v3.3.14

v3.3.13

Bug Fix

  • kubernetes: Fix K8S suppressions annotations - #​7651

v3.3.12

Bug Fix

  • sca: correct Windows path handling in image referencer - #​7650

v3.3.11

v3.3.10

v3.3.9

Bug Fix

  • terraform: handle null container_properties in aws_batch_job_def… - #​7636

v3.3.8

Bug Fix

  • kubernetes: CKV_K8S_40 should pass when hostUsers is false - #​7580

v3.3.7

Feature

  • general: fix github only output for sca - #​7598

v3.3.6

v3.3.5

Feature

  • general: fix danger node version - #​7589

Bug Fix

  • general: retry kustomize/helm install to survive transient GitHub failures - #​7591
  • terraform: CKV_AZURE_190 override singular get_expected_value - #​7592

v3.3.4

v3.3.3

v3.3.2

Bug Fix

  • terraform_plan: handle computed log_bucket in CKV_GCP_62 and CKV_GCP_63 - #​7582
  • terraform: pass CKV_GCP_123 when remove_default_node_pool is true - #​7575

v3.3.1

Feature

  • serverless: disable vars opt out - #​7574
github/codeql-action

v4.39.3

Compare Source

  • Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #​4283

v4.39.2

Compare Source

  • Update default CodeQL bundle version to 2.27.4. #​4284
  • Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4266
  • Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #​4221
  • The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The `analyze

[!IMPORTANT]
✂ PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner September 24, 2026 21:22
@github-actions

github-actions Bot commented Sep 24, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 16s —— View job


Review: PR #291

I found no bugs, security issues or performance problems.

  • The same full-length SHA pin (9171db3e…) is applied to all four places that use it. No copy of the old digest (8cf3482) is left anywhere in the repo, so none of the pins is out of step.
  • The pins stay on full commit SHAs, and the existing zizmor: ignore annotations are unchanged.
  • Upstream's v1.0.234 release has no notes. From what's in the PR, it looks like a plain patch bump with no new inputs or permissions.

Release note: .github/actions/ai-pr-review is a shared composite action. Callers get this bump only after its floating tag is moved to the merge commit (see the Release Process section in CLAUDE.md). The change asks nothing new of callers, so moving the existing tag is fine.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 754b98d to 9f43891 Compare September 25, 2026 11:16
@github-actions

github-actions Bot commented Sep 25, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 18s —— View job


Review: PR #291

I found no bugs, security issues or performance problems.

  • All four uses of anthropics/claude-code-action now point at the same full commit SHA (9171db3e…). The old SHA (8cf3482) no longer appears anywhere in the repo's YAML.
  • actions/checkout goes to v6.1.0 (d23441a4…) in test-platform-release.yaml. That file was the last workflow still pinned to v6. Every other workflow and composite action is on v7.0.1, so this bump leaves nothing behind. Some README examples still say v6.0.2, but that is documentation and changes nothing at runtime.
  • The pins are still full commit SHAs, and the zizmor: ignore annotations are unchanged.

Release note: .github/actions/ai-pr-review is a shared composite action. Merging this PR does not reach its callers until the action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). The bump asks nothing new of callers, so it is fine to move the existing tag rather than cut a new major.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 9f43891 to f34ea1b Compare September 25, 2026 11:29
@github-actions

github-actions Bot commented Sep 25, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 16s —— View job


Review: PR #291

I found no bugs, security issues or performance problems.

  • All four uses of anthropics/claude-code-action now point at the same full commit SHA (9171db3e…). The old SHA (8cf3482) no longer appears anywhere under .github/.
  • The actions/checkout change that the previous review covered is no longer in this PR. That is expected: test-platform-release.yaml is already on v7.0.1 on main (from chore(deps): update actions/checkout action to v7 #292), so the rebase dropped it.
  • The pins are still full commit SHAs, and the zizmor: ignore annotations are unchanged.

Release note: .github/actions/ai-pr-review is a shared composite action. Merging this PR does not reach its callers until the action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). The bump asks nothing new of callers, so it is fine to move the existing tag rather than cut a new major.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from f34ea1b to 575b401 Compare September 25, 2026 22:17
@github-actions

github-actions Bot commented Sep 25, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 14s —— View job


Review: PR #291

I found no bugs, security issues or performance problems.

  • Renovate has pushed a new commit. All four uses of anthropics/claude-code-action now point at 756cc22e… (v1.0.235). The earlier reviews on this PR checked the previous pin, 9171db3e…. Neither the old digest (8cf3482) nor 9171db3e appears anywhere under .github/, so no pin is out of step with the others.
  • The pins are still full commit SHAs, and the zizmor: ignore annotations are unchanged.
  • Upstream's v1.0.234 and v1.0.235 releases have no notes. The changed lines only move the SHA; no inputs or permissions change.

Release note: .github/actions/ai-pr-review is a shared composite action. Merging this PR does not reach its callers until the action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). The bump asks nothing new of callers, so moving the existing tag is fine.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 575b401 to ab878b6 Compare September 28, 2026 19:18
@github-actions

github-actions Bot commented Sep 28, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 13s —— View job


Review: PR #291

I found no bugs, security issues or performance problems.

  • Renovate pushed a new commit. All four uses of anthropics/claude-code-action now point at 8ce9314f… (v1.0.236). The earlier reviews on this PR checked older pins. No other claude-code-action pin is left under .github/, so none of the pins is out of step.
  • The pins are still full commit SHAs, and the zizmor: ignore annotations are unchanged.
  • Upstream's v1.0.234–v1.0.236 releases have no notes. The changed lines only move the SHA; no inputs or permissions change.

Release note: .github/actions/ai-pr-review is a shared composite action. Merging this PR does not reach its callers until the action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). The bump asks nothing new of callers, so moving the existing tag is fine.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from ab878b6 to a5f62aa Compare September 29, 2026 20:10
@github-actions

github-actions Bot commented Sep 29, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 18s —— View job


Review: PR #291

I found no bugs, security issues or performance problems.

  • Renovate pushed a new commit. All four uses of anthropics/claude-code-action now point at fd1c1286… (v1.0.237). No other claude-code-action pin is left under .github/, so none of the pins is out of step.
  • The pins are still full commit SHAs, and the zizmor: ignore annotations are unchanged.
  • Upstream's v1.0.234–v1.0.237 releases have no notes. The changed lines only move the SHA; no inputs or permissions change.

Release note: .github/actions/ai-pr-review is a shared composite action. Merging this PR does not reach its callers until the action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). The bump asks nothing new of callers, so moving the existing tag is fine.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from a5f62aa to b05e956 Compare September 29, 2026 21:16
@github-actions

github-actions Bot commented Sep 29, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 28s —— View job


Review: PR #291

I found no bugs, security issues or performance problems.

Release note: ai-pr-review and govulncheck are both shared composite actions. Merging this PR does not reach their callers until each action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). Neither bump asks anything new of callers, so moving the existing tags is fine and no new major is needed.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from b05e956 to 1757163 Compare September 30, 2026 19:26
@github-actions

github-actions Bot commented Sep 30, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 22s —— View job


Review: PR #291

I found no bugs, security issues or performance problems.

  • Renovate pushed a new commit. All four uses of anthropics/claude-code-action now point at 12dd8d74… (v1.0.238), and no older pin is left under .github/. The pins are still full commit SHAs, and the zizmor: ignore annotations haven't changed.
  • The ci-test-notify bump in .github/actions/govulncheck/action.yml:91 (c6a76f1 → e9b507c, feat(ci-test-notify): add info status and none run link position #298) is the same as in the last review. feat(ci-test-notify): add info status and none run link position #298 only adds an info status and a run-link-position: none option. govulncheck sends status: failure with the default link position, so its Slack message is unchanged.
  • Upstream's v1.0.234–v1.0.238 releases have no notes. The changed lines only move the SHA, and no inputs or permissions change.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see the Release Process section in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 1757163 to 494017c Compare October 1, 2026 08:25
@github-actions

github-actions Bot commented Oct 1, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 16s —— View job


Review: PR #291

I found no bugs, security issues or performance problems.

  • New in this push: .github/workflows/actionlint.yaml:38 moves reviewdog/action-actionlint from v1.77.0 to v1.78.0 (1129829f…). Upstream's release notes list only dependency bumps (actions-create-release, pyflakes). No inputs change, and the github_token and reporter inputs it passes stay the same.
  • All four uses of anthropics/claude-code-action still point at 12dd8d74… (v1.0.238), and no older pin is left under .github/. The pins are still full commit SHAs, and the zizmor: ignore annotations haven't changed.
  • The ci-test-notify bump in govulncheck/action.yml:91 (c6a76f1 → e9b507c, feat(ci-test-notify): add info status and none run link position #298) hasn't changed since the last review. Its Slack message stays the same.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see Release Process in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 494017c to de210f3 Compare October 1, 2026 18:03
@github-actions

github-actions Bot commented Oct 1, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 49s —— View job


Review: PR #291

Bug: this push rolls cve-scan back to an older ci-test-notify, which undoes #300

.github/actions/cve-scan/action.yml:167 and :197 change the ci-test-notify pin from 2c8ba9b to e9b507c. That is a downgrade: e9b507c is an ancestor of 2c8ba9b, and the only change between the two commits is #299, which added the footer-text input.

cve-scan passes that input at :185 and :220 (footer-text: "View run #…"). At e9b507c the input doesn't exist, so:

Likely cause: the # ci-test-notify/v1 tag comment. Renovate pins each SHA to whatever the tag points at, so the floating tag probably still points at e9b507c, which means it wasn't moved after #299 merged (pin drift). I couldn't confirm this: git ls-remote needed an approval I don't have.

Fix (pick one):

  • Advance the tag to a commit that includes feat(ci-test-notify): let callers set the footer link text #299, e.g. git tag -f ci-test-notify/v1 origin/main && git push origin ci-test-notify/v1 --force. Then have Renovate rebase, and it will re-pin all ci-test-notify uses forward.
  • Or revert the two cve-scan lines in this PR to 2c8ba9b4c4be9e873fac4898cfb4ea2eddb5faed.

Advancing the tag is safe. #299 only adds an optional input, so it asks nothing new of callers.

Fix this →

Everything else is unchanged since the last review and has no problems: the claude-code-action pins on 12dd8d74… (v1.0.238), the govulncheck ci-test-notify bump (c6a76f1 → e9b507c is forward, and govulncheck doesn't use footer-text), and action-actionlint v1.78.0.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from de210f3 to dbe7115 Compare October 1, 2026 19:17
@github-actions

github-actions Bot commented Oct 1, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 20s —— View job


Review: PR #291

I found no bugs, security issues or performance problems.

  • The cve-scan downgrade from the last review is fixed. cve-scan/action.yml is no longer in the diff, and both of its ci-test-notify pins stay on 2c8ba9b (feat(ci-test-notify): let callers set the footer link text #299, which has footer-text). The notification_pins.bats guard expects exactly that SHA.
  • govulncheck/action.yml:91 now moves ci-test-notify from c6a76f1 to 2c8ba9b. That is forward: c6a76f1 is an ancestor of 2c8ba9b. The only commits in between are feat(ci-test-notify): add info status and none run link position #298 and feat(ci-test-notify): let callers set the footer link text #299, and both just add optional inputs. govulncheck uses neither, so its Slack message is unchanged.
  • All four uses of anthropics/claude-code-action now point at 97c53473… (v1.0.239), and no older pin is left under .github/. The pins are still full commit SHAs, and the zizmor: ignore annotations haven't changed.
  • reviewdog/action-actionlint v1.78.0 is the same as in the last review: upstream only bumped dependencies.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see Release Process in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from dbe7115 to f23c484 Compare October 2, 2026 06:17
@github-actions

github-actions Bot commented Oct 2, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 21s —— View job


Review: PR #291

I found no bugs, security issues or performance problems.

  • New in this push: .github/workflows/actionlint.yaml:38 moves reviewdog/action-actionlint from v1.78.0 to v1.78.1 (13465d02…). Upstream's only change is a bump of the Python docker tag to 3.14.8. The inputs stay the same, and this workflow still passes the same github_token and reporter.
  • All four uses of anthropics/claude-code-action still point at 97c53473… (v1.0.239), and no older pin is left under .github/. The pins are still full commit SHAs, and the zizmor: ignore annotations haven't changed.
  • govulncheck/action.yml:91 still moves ci-test-notify forward from c6a76f1 to 2c8ba9b, the same as in the last review. Both cve-scan pins stay on 2c8ba9b, so the downgrade flagged two reviews ago has not come back.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see Release Process in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from f23c484 to cd3f913 Compare October 2, 2026 20:37
@github-actions

github-actions Bot commented Oct 2, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 52s —— View job


Review: PR #291

Bug: this push rolls cve-scan back to a ci-test-notify that breaks on jq 1.6, undoing #303

.github/actions/cve-scan/action.yml:167 and :197 change the pin from d15a1df (on main since #303) to 2c8ba9b. That is a downgrade, because 2c8ba9b is an ancestor of d15a1df. The only ci-test-notify change between the two is #302. It added the else . branch to SLACK_ESCAPE_CHARS in build-payload.sh:23–24.

  • jq 1.6 rejects an if … elif … end that has no else. jq 1.6 is the version on ubuntu-22.04, where the scheduled scans run.
  • cve-scan passes footer-text (:185, :220), and that input sends the footer through the broken filter (build-payload.sh:115, :119). On 22.04 the jq call fails, so no payload is built. The step is advisory, so the Slack alert for a found CVE or a scanner error is dropped and nothing goes red.
  • .github/actions/cve-scan/test/notification_pins.bats:8 expects exactly d15a1df, so make test fails on this branch.

Likely cause: pin drift again, like the earlier e9b507c rollback on this PR. Renovate re-pins to whatever ci-test-notify/v1 points at, and that tag apparently still points at 2c8ba9b. It wasn't moved after #302 merged. I couldn't check this myself because git fetch/ls-remote needs approval I don't have.

Fix (pick one):

  • Advance the tag: git tag -f ci-test-notify/v1 d15a1df8ea70c58cf70343f7c3687a6014ed63f8 && git push origin ci-test-notify/v1 --force, then tick Renovate's rebase box. This is safe because fix(ci-test-notify): add the else branch jq 1.6 needs in the footer escape #302 is a pure bug fix and asks nothing new of callers.
  • Or revert the two cve-scan lines in this PR to d15a1df8ea70c58cf70343f7c3687a6014ed63f8.

Fix this →

govulncheck is fine. govulncheck/action.yml:91 moves from c6a76f1 to 2c8ba9b, which is forward. govulncheck doesn't pass footer-text, so it never runs the broken filter. Once the tag is advanced, Renovate will move it to d15a1df as well.

Nothing else changed since the last review: claude-code-action is on 97c53473… (v1.0.239) in all four places, and action-actionlint is on v1.78.1.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from cd3f913 to 0a8dec2 Compare October 2, 2026 21:17
@github-actions

github-actions Bot commented Oct 2, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 22s —— View job


Review: PR #291

I found no bugs, security issues or performance problems.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see Release Process in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 0a8dec2 to 499e299 Compare October 4, 2026 00:16
@github-actions

github-actions Bot commented Oct 4, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 14s —— View job


Review: PR #291

I found no bugs, security issues or performance problems.

  • New in this push: all four uses of anthropics/claude-code-action now point at cab360f6… (v1.0.241). No older pin is left under .github/. The pins are still full commit SHAs, and the zizmor: ignore annotations haven't changed. Upstream's v1.0.239–v1.0.241 releases have no notes. The changed lines only move the SHA, and no inputs or permissions change.
  • govulncheck/action.yml:91 still moves ci-test-notify forward from c6a76f1 to d15a1df. That matches both cve-scan pins (:167, :197), which are not in the diff, so the downgrade flagged in earlier reviews has not come back.
  • reviewdog/action-actionlint v1.78.1 is the same as in the last review.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see Release Process in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

@github-actions

github-actions Bot commented Nov 5, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 23s —— View job


Review: PR #291

This push adds no new bugs or security issues. Three issues from earlier reviews are still open.

  • New in this push: Renovate rebased onto feat(ci): add bounded retries for approved pull requests #340 (retry-approved-pr-ci). The new test-retry-approved-pr-ci.yaml:23 now moves astral-sh/setup-uv from v10.2.0 to v10.3.3 (68559e99…). It is a test-only workflow, the step passes no inputs, and the pin is a full SHA. The diff is now 58 files, +63/−63. I grepped .github/ for the old setup-uv, create-github-app-token and claude-code-action digests and for checkov:3.3, and none are left.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:197) and permission-members (secret-broker-request/action.yml:37). If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I haven't checked this. Please confirm both inputs exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.
  • Checkov 3.3.0 → 3.4.3 (checkov/action.yml): a minor bump can add or tighten policies, and 3.4.2 also hardens the defaults for network and credential handling. A caller that doesn't set soft_fail could start failing on IaC that passed under 3.3.0, with no change on their side. If callers gate on Checkov, leave the existing tag alone or tell them before you advance it.

These haven't changed since the last review and have no problems: claude-code-action on c0949c50… (v1.0.268) in all four places, docker/login-action v4.8.0 (check that the promote-release smoke job passed before you advance that tag), cosign-installer v4.1.3 (both copies on the same SHA), bats-action 4.1.0 (36 steps, all in test workflows), action-actionlint v1.81.1, codeql-action/upload-sarif v4.39.3, and setup-kubectl v5.2.0.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved by the shared auto-approve workflow because this PR matched the approval criteria.

For more information, see https://github.com/loft-sh/github-actions?tab=readme-ov-file#auto-approve-bot-prs.

@github-actions

github-actions Bot commented Nov 5, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 23s —— View job


Review: PR #291

This push adds no new bugs or security issues. Three issues from earlier reviews are still open, and one of them now affects one more file.

  • New in this push: Renovate rebased onto feat: advance action tags after merge #351 (advance action tags after merge) and picked up two files it had not touched before. The diff is now 60 files, +65/−65.
    • test-advance-action-tags.yaml:28 moves bats-action to 4.1.0 (3566550e…). This is a test-only workflow, it passes only the *-install: false inputs, and the pin is a full SHA.
    • fork-review-advisory.yaml:51 moves create-github-app-token to v3.3.0 (64ab729a…). This step passes permission-metadata, permission-contents and permission-pull-requests, all set to read. That puts it under the open item below.
  • No old create-github-app-token digest is left under .github/.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399 is titled "update permission inputs". It may affect the permission-* inputs used in three places:

    • comment-triggered-check/action.yml:197
    • secret-broker-request/action.yml:37
    • fork-review-advisory.yaml:57–59 (new in this push)

    If any of those inputs was renamed, GitHub only logs a warning, and the token is created with the app's full installation permissions instead of the narrower scope. For fork-review-advisory, that token is meant to be fork-scoped and read-only. I haven't checked this. Please confirm all of these inputs still exist at 64ab729 before merging.

  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners. With feat: advance action tags after merge #351 now on main, add the major-release label before merging. Otherwise the new tag workflow will advance the existing ai-pr-review tag automatically.

  • Checkov 3.3.0 → 3.4.3 (checkov/action.yml): a minor bump can add or tighten policies, and 3.4.2 also hardens the defaults for network and credential handling. A caller that doesn't set soft_fail could start failing on IaC that passed under 3.3.0, without changing anything on their side. Because feat: advance action tags after merge #351 now advances tags on merge, this upgrade will reach callers automatically unless the PR is labelled major-release or the checkov tag is handled by hand.

These haven't changed since the last review and have no problems: claude-code-action on c0949c50… (v1.0.268), docker/login-action v4.8.0 (check that the promote-release smoke job passed), cosign-installer v4.1.3, action-actionlint v1.81.1, codeql-action/upload-sarif v4.39.3, setup-uv v10.3.3, and setup-kubectl v5.2.0.

@github-actions

github-actions Bot commented Nov 6, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 19s —— View job


Review: PR #291

This push adds no new bugs or security issues. Three issues from earlier reviews are still open.

  • New in this push: .github/workflows/actionlint.yaml moves reviewdog/action-actionlint from v1.81.1 to v1.81.2 (7abf25e1…). The PR body's table still says v1.81.1 and has no notes for v1.81.2. Every earlier release in this range only bumped dependencies. The pin is still a full SHA. This workflow only lints this repo, so nothing from it reaches callers.
  • The diff is still 60 files, +65/−65. No old digest from this group is left in it, and each package is on a single SHA.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect the permission-* inputs used at comment-triggered-check/action.yml:197, secret-broker-request/action.yml:37 and fork-review-advisory.yaml:57–59. If any of them was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. For fork-review-advisory, that token is meant to be fork-scoped and read-only. I haven't checked this. Please confirm these inputs exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. If you want that, add the major-release label before merging. Otherwise the tag workflow from feat: advance action tags after merge #351 will advance the existing tag automatically.
  • Checkov 3.3.0 → 3.4.3 (checkov/action.yml): a minor bump can add or tighten policies, and 3.4.2 also hardens the defaults for network and credential handling. A caller that doesn't set soft_fail could start failing on IaC that passed before, without changing anything on their side. The tag will advance on merge unless the PR is labelled major-release.

These haven't changed since the last review and have no problems: claude-code-action on c0949c50… (v1.0.268), docker/login-action v4.8.0 (check that the promote-release smoke job passed), cosign-installer v4.1.3, bats-action 4.1.0, codeql-action/upload-sarif v4.39.3, setup-uv v10.3.3 and setup-kubectl v5.2.0.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved by the shared auto-approve workflow because this PR matched the approval criteria.

For more information, see https://github.com/loft-sh/github-actions?tab=readme-ov-file#auto-approve-bot-prs.

@github-actions

github-actions Bot commented Nov 6, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 25s —— View job


Review: PR #291

This push adds no new bugs or security issues. Three issues from earlier reviews are still open.

  • New in this push: all four anthropics/claude-code-action pins moved to 61a9c274… (v1.0.269): ai-pr-review/action.yml:98, claude.yaml:30, claude.yml:36 and claude-code-review.yaml:57. The changed lines only move the SHA. This review job ran on 61a9c274, so the new pin has run end to end once. The PR body's table still says v1.0.268.
  • I grepped .github/ for every old digest in this group and for checkov:3.3, and none are left. The diff is still 60 files, +65/−65.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect the permission-* inputs used at comment-triggered-check/action.yml:197, secret-broker-request/action.yml:37 and fork-review-advisory.yaml:57–59. If any of them was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. For fork-review-advisory, that token is meant to be fork-scoped and read-only. I haven't checked this. Please confirm these inputs exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. If you want that, add the major-release label before merging. Otherwise the tag workflow from feat: advance action tags after merge #351 will advance the existing tag automatically.
  • Checkov 3.3.0 → 3.4.3 (checkov/action.yml): a minor bump can add or tighten policies, and 3.4.2 also hardens the defaults for network and credential handling. A caller that doesn't set soft_fail could start failing on IaC that passed before, without changing anything on their side. The tag will advance on merge unless the PR is labelled major-release.

These haven't changed since the last review and have no problems: docker/login-action v4.8.0 (check that the promote-release smoke job passed), cosign-installer v4.1.3, bats-action 4.1.0, action-actionlint v1.81.2, codeql-action/upload-sarif v4.39.3, setup-uv v10.3.3 and setup-kubectl v5.2.0.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved by the shared auto-approve workflow because this PR matched the approval criteria.

For more information, see https://github.com/loft-sh/github-actions?tab=readme-ov-file#auto-approve-bot-prs.

@github-actions

github-actions Bot commented Nov 7, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 22s —— View job


Review: PR #291

This push doesn't add any bugs or security issues. Three problems from earlier reviews are still open.

  • New in this push: .github/workflows/actionlint.yaml moves reviewdog/action-actionlint from v1.81.2 to v1.83.0 (a7d35aaf…). The PR body only goes up to v1.81.2, so I haven't seen release notes for v1.82 or v1.83. The pin is still a full SHA. This workflow only lints this repo, so callers get nothing from it. If the new version adds lint rules that fail, this PR's own CI will show it.
  • The diff is still 60 files, +65/−65. It has no old digest from this group, and every package is on a single SHA.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399 is titled "update permission inputs". It may affect the permission-* inputs at comment-triggered-check/action.yml:197, secret-broker-request/action.yml:37 and fork-review-advisory.yaml:57–59. If any of them was renamed, GitHub only logs a warning and creates the token with the app's full installation permissions instead of the narrower scope. I haven't checked this. Please confirm these inputs still exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so under CLAUDE.md it calls for a new ai-pr-review major. To get that, add the major-release label before merging. Without the label, the tag workflow from feat: advance action tags after merge #351 will move the existing tag.
  • Checkov 3.3.0 → 3.4.3 (checkov/action.yml): a minor bump can add or tighten policies, and 3.4.2 also hardens the defaults for network and credential handling. A caller that doesn't set soft_fail could start failing on IaC that passed before, without changing anything on their side. The checkov tag will move on merge unless the PR has the major-release label.

These haven't changed since the last review and have no problems: claude-code-action on 61a9c274… (v1.0.269), docker/login-action v4.8.0 (check that the promote-release smoke job passed), cosign-installer v4.1.3, bats-action 4.1.0, codeql-action/upload-sarif v4.39.3, setup-uv v10.3.3 and setup-kubectl v5.2.0.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved by the shared auto-approve workflow because this PR matched the approval criteria.

For more information, see https://github.com/loft-sh/github-actions?tab=readme-ov-file#auto-approve-bot-prs.

@github-actions

github-actions Bot commented Nov 9, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 22s —— View job


Review: PR #291

This push adds no new bugs or security issues. Three issues from earlier reviews are still open.

  • New in this push: peter-evans/create-pull-request v8.1.1 → v8.1.2 (15733dbd…) at .github/actions/go-licenses/action.yml:136. The PR body's table doesn't list this bump. It is a patch release. The step passes only standard inputs (token, committer, branch, commit-message, title, body, signoff, delete-branch), and the pin is a full SHA. This is the only create-pull-request use under .github/. The bump asks nothing new of callers, so moving the existing go-licenses tag after merge is fine.
  • The diff is now 61 files, +66/−66. Each package in this group is on a single SHA, and the diff has no old digest left in it.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect the permission-* inputs at these three places:

    • comment-triggered-check/action.yml:197
    • secret-broker-request/action.yml:37
    • fork-review-advisory.yaml:57–59

    If any of those inputs was renamed, GitHub only logs a warning. The token then gets the app's full installation permissions instead of the narrower scope. I haven't checked this. Please confirm the inputs still exist at 64ab729 before merging.

  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so CLAUDE.md calls for a new ai-pr-review major. To get one, add the major-release label before merging. Without the label, the tag workflow from feat: advance action tags after merge #351 moves the existing tag.

  • Checkov 3.3.0 → 3.4.3 (checkov/action.yml): a minor bump can add or tighten policies, and 3.4.2 also hardens the defaults for network and credential handling. A caller that doesn't set soft_fail could start failing on IaC that passed before, without changing anything on their side. The checkov tag moves on merge unless the PR has the major-release label.

These haven't changed since the last review and have no problems:

  • claude-code-action on 61a9c274… (v1.0.269)
  • docker/login-action v4.8.0 (check that the promote-release smoke job passed)
  • cosign-installer v4.1.3
  • bats-action 4.1.0
  • action-actionlint v1.83.0
  • codeql-action/upload-sarif v4.39.3
  • setup-uv v10.3.3
  • setup-kubectl v5.2.0

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved by the shared auto-approve workflow because this PR matched the approval criteria.

For more information, see https://github.com/loft-sh/github-actions?tab=readme-ov-file#auto-approve-bot-prs.

@github-actions

github-actions Bot commented Nov 9, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 27s —— View job


Review: PR #291

This push adds no new bugs or security issues. Three issues from earlier reviews are still open.

  • New in this push: all four anthropics/claude-code-action pins moved to 9eb012b6… (v1.0.270). The changed lines only move the SHA. This review job ran on 9eb012b6, so the new pin has run end to end once. The PR body's table still says v1.0.269.
  • I grepped .github/ for every old digest in this group and for checkov:3.3, and none are left. Every claude-code-action pin is on the same SHA. The diff is still 61 files, +66/−66.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect the permission-* inputs at comment-triggered-check/action.yml:197, secret-broker-request/action.yml:37 and fork-review-advisory.yaml:57–59. If any of them was renamed, GitHub only logs a warning and creates the token with the app's full installation permissions instead of the narrower scope. I haven't checked this. Please confirm these inputs still exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so CLAUDE.md calls for a new ai-pr-review major. To get one, add the major-release label before merging. Without the label, the tag workflow from feat: advance action tags after merge #351 moves the existing tag.
  • Checkov 3.3.0 → 3.4.3 (checkov/action.yml): a minor bump can add or tighten policies, and 3.4.2 also hardens the defaults for network and credential handling. A caller that doesn't set soft_fail could start failing on IaC that passed before, without changing anything on their side. The checkov tag moves on merge unless the PR has the major-release label.

These haven't changed since the last review and have no problems: create-pull-request v8.1.2, docker/login-action v4.8.0 (check that the promote-release smoke job passed), cosign-installer v4.1.3, bats-action 4.1.0, action-actionlint v1.83.0, codeql-action/upload-sarif v4.39.3, setup-uv v10.3.3 and setup-kubectl v5.2.0.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved by the shared auto-approve workflow because this PR matched the approval criteria.

For more information, see https://github.com/loft-sh/github-actions?tab=readme-ov-file#auto-approve-bot-prs.

@github-actions

github-actions Bot commented Nov 10, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 23s —— View job


Review: PR #291

This push adds no new bugs or security issues. Three issues from earlier reviews are still open.

New in this push:

  • azure/setup-helm v5.0.1 → v5.1.0 (2f5e7bc6…) in publish-helm-chart/action.yml:54 and prerelease-setup/action.yml:68. The PR body's table doesn't list this bump, so I haven't seen release notes for it. publish-helm-chart passes only version, prerelease-setup passes no inputs, and both pins are full SHAs. The publish-helm-chart bats suite and the prerelease-setup smoke test on this PR's CI exercise both steps. Check that they passed before you advance either tag.
  • All four anthropics/claude-code-action pins moved to 4fa93a88… (v1.0.271). This review job ran on 4fa93a88, so the new pin has run end to end once.
  • The diff is now 62 files, +68/−68. I grepped .github/ for the old digests of setup-helm, claude-code-action, bats-action, setup-uv and create-github-app-token, and for checkov:3.3. None are left, so each package is on a single SHA.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect the permission-* inputs at comment-triggered-check/action.yml:197, secret-broker-request/action.yml:37 and fork-review-advisory.yaml:57–59. If any of those inputs was renamed, GitHub only logs a warning and creates the token with the app's full installation permissions instead of the narrower scope. I haven't checked this. Please confirm the inputs still exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so CLAUDE.md calls for a new ai-pr-review major. To get one, add the major-release label before merging. Without the label, the tag workflow from feat: advance action tags after merge #351 moves the existing tag.
  • Checkov 3.3.0 → 3.4.3 (checkov/action.yml): a minor bump can add or tighten policies, and 3.4.2 also hardens the defaults for network and credential handling. A caller that doesn't set soft_fail could start failing on IaC that passed before, without changing anything on their side. The checkov tag moves on merge unless the PR has the major-release label.

These haven't changed since the last review and have no problems: create-pull-request v8.1.2, docker/login-action v4.8.0 (check that the promote-release smoke job passed), cosign-installer v4.1.3, bats-action 4.1.0, action-actionlint v1.83.0, codeql-action/upload-sarif v4.39.3, setup-uv v10.3.3 and setup-kubectl v5.2.0.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved by the shared auto-approve workflow because this PR matched the approval criteria.

For more information, see https://github.com/loft-sh/github-actions?tab=readme-ov-file#auto-approve-bot-prs.

@github-actions

github-actions Bot commented Nov 10, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 18s —— View job


Review: PR #291

This push adds no new bugs or security issues. Three issues from earlier reviews are still open.

  • New in this push: .github/workflows/actionlint.yaml moves reviewdog/action-actionlint from v1.83.0 to v1.84.0 (78b29637…). The PR body's table still says v1.83.0 and has no notes for v1.84.0. The pin is still a full SHA. This workflow only lints this repo, so callers get nothing from it. If the new version adds lint rules that fail, this PR's own CI will show it.
  • The diff is still 62 files, +68/−68. Each package in this group is on a single SHA, and the diff has no old digest left in it.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect the permission-* inputs at comment-triggered-check/action.yml:197, secret-broker-request/action.yml:37 and fork-review-advisory.yaml:57–59. If any of those inputs was renamed, GitHub only logs a warning and creates the token with the app's full installation permissions instead of the narrower scope. I haven't checked this. Please confirm the inputs still exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so CLAUDE.md calls for a new ai-pr-review major. To get one, add the major-release label before merging. Without the label, the tag workflow from feat: advance action tags after merge #351 moves the existing tag.
  • Checkov 3.3.0 → 3.4.3 (checkov/action.yml): a minor bump can add or tighten policies, and 3.4.2 also hardens the defaults for network and credential handling. A caller that doesn't set soft_fail could start failing on IaC that passed before, without changing anything on their side. The checkov tag moves on merge unless the PR has the major-release label.

These haven't changed since the last review and have no problems: claude-code-action on 4fa93a88… (v1.0.271), setup-helm v5.1.0 (check that the publish-helm-chart and prerelease-setup tests passed), create-pull-request v8.1.2, docker/login-action v4.8.0 (check that the promote-release smoke job passed), cosign-installer v4.1.3, bats-action 4.1.0, codeql-action/upload-sarif v4.39.3, setup-uv v10.3.3 and setup-kubectl v5.2.0.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved by the shared auto-approve workflow because this PR matched the approval criteria.

For more information, see https://github.com/loft-sh/github-actions?tab=readme-ov-file#auto-approve-bot-prs.

@github-actions

github-actions Bot commented Nov 10, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 20s —— View job


Review: PR #291

This push adds no new bugs or security issues. Three issues from earlier reviews are still open.

  • New in this push: Renovate rebased onto feat(fork-review-check): accept dated exceptions for unlinked commit authors #373 (fork-review-check). peter-evans/create-pull-request at go-licenses/action.yml:136 now goes to v8.1.3 (3ffccacd…). The last review saw v8.1.2, and the PR body's table still says v8.1.2, so there are no release notes for v8.1.3. It's a patch release, the step passes only standard inputs, and the pin is a full SHA.
  • The diff is still 62 files, +68/−68. Every package in this group moves from exactly one old SHA to one new SHA, and no old digest is left in the diff.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): the PR body now confirms the headline change is #399, "update permission inputs". That may affect the permission-* inputs at comment-triggered-check/action.yml:197, secret-broker-request/action.yml:37 and fork-review-advisory.yaml:57–59. If any of those inputs was renamed, GitHub only logs a warning and creates the token with the app's full installation permissions instead of the narrower scope. I haven't checked this. Please confirm the inputs still exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so CLAUDE.md calls for a new ai-pr-review major. To get one, add the major-release label before merging. Without the label, the tag workflow from feat: advance action tags after merge #351 moves the existing tag.
  • Checkov 3.3.0 → 3.4.3 (checkov/action.yml): a minor bump can add or tighten policies, and 3.4.2 also hardens the defaults for network and credential handling. A caller that doesn't set soft_fail could start failing on IaC that passed before, without changing anything on their side. The checkov tag moves on merge unless the PR has the major-release label.

These haven't changed since the last review and have no problems: claude-code-action on 4fa93a88… (v1.0.271), setup-helm v5.1.0, docker/login-action v4.8.0 (check that the promote-release smoke job passed), cosign-installer v4.1.3, bats-action 4.1.0, action-actionlint v1.84.0, codeql-action/upload-sarif v4.39.3, setup-uv v10.3.3 and setup-kubectl v5.2.0.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved by the shared auto-approve workflow because this PR matched the approval criteria.

For more information, see https://github.com/loft-sh/github-actions?tab=readme-ov-file#auto-approve-bot-prs.

@github-actions

github-actions Bot commented Nov 10, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 26s —— View job


Review: PR #291

This push adds no new bugs or security issues. Three issues from earlier reviews are still open. One assumption from earlier reviews no longer holds.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect the permission-* inputs at comment-triggered-check/action.yml:197, secret-broker-request/action.yml:37 and fork-review-advisory.yaml:57–59. If one of them was renamed, GitHub only logs a warning and mints the token with the app's full installation permissions. I haven't checked this. Please confirm the inputs still exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153), it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so under CLAUDE.md it needs a new ai-pr-review major. To get one, add the major-release label before merging. Without the label, the tag workflow from feat: advance action tags after merge #351 moves the existing tag.
  • Checkov 3.3.0 → 3.4.3 (checkov/action.yml): a minor bump can add or tighten policies. 3.4.2 also hardens the defaults for network and credential handling. A caller that doesn't set soft_fail could start failing on IaC that passed before, without changing anything on their side. The checkov tag moves on merge unless the PR has the major-release label.

These haven't changed since the last review and have no problems: claude-code-action (v1.0.271), create-pull-request v8.1.3, setup-helm v5.1.0, docker/login-action v4.8.0 (check that the promote-release smoke job passed), cosign-installer v4.1.3, bats-action 4.1.0, action-actionlint v1.84.0, setup-uv v10.3.3 and setup-kubectl v5.2.0.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved by the shared auto-approve workflow because this PR matched the approval criteria.

For more information, see https://github.com/loft-sh/github-actions?tab=readme-ov-file#auto-approve-bot-prs.

@github-actions

github-actions Bot commented Nov 10, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 21s —— View job


Review: PR #291

This push adds no new bugs or security issues. Three issues from earlier reviews are still open.

  • New in this push: Renovate rebased onto feat(ci): join the testing tailnet with workflow identity #376 (testing tailnet with workflow identity). That commit's test-testing-tailnet.yaml:18 now moves astral-sh/setup-uv from v10.2.0 to v10.3.3 (68559e99…). It's a test-only workflow, the step passes no inputs, and the pin is a full SHA. The diff is now 63 files, +69/−69.
  • I searched .github/ for the old bats-action, setup-uv, create-github-app-token and claude-code-action digests and for checkov:3.3, and found none of them. Each package in this group now moves from one old SHA to one new SHA.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect the permission-* inputs at comment-triggered-check/action.yml:197, secret-broker-request/action.yml:37 and fork-review-advisory.yaml:57–59. If one of them was renamed, GitHub only logs a warning and creates the token with the app's full installation permissions instead of the narrower scope. I haven't checked this. Please confirm the inputs still exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so CLAUDE.md calls for a new ai-pr-review major. To get one, add the major-release label before merging. Without the label, the tag workflow from feat: advance action tags after merge #351 moves the existing tag.
  • Checkov 3.3.0 → 3.4.3 (checkov/action.yml): a minor bump can add or tighten policies, and 3.4.2 also hardens the defaults for network and credential handling. A caller that doesn't set soft_fail could start failing on IaC that passed before, without changing anything on their side. The checkov tag moves on merge unless the PR has the major-release label.

These haven't changed since the last review and have no problems: claude-code-action (v1.0.271), create-pull-request v8.1.3, setup-helm v5.1.0, docker/login-action v4.8.0 (check that the promote-release smoke job passed), cosign-installer v4.1.3, bats-action 4.1.0, action-actionlint v1.84.0, codeql-action/upload-sarif v4.39.3 (check the first scheduled run, since #377 made upload failures fail the job) and setup-kubectl v5.2.0.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved by the shared auto-approve workflow because this PR matched the approval criteria.

For more information, see https://github.com/loft-sh/github-actions?tab=readme-ov-file#auto-approve-bot-prs.

@github-actions

github-actions Bot commented Nov 11, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 33s —— View job


Review: PR #291

This push adds no new bugs or security issues. Three issues from earlier reviews are still open.

  • New in this push: Renovate rebased onto chore(ci): remove pull_request_target from privileged workflows #349, which removes pull_request_target from the privileged workflows. Checkov also moves to 3.4.4 (.github/actions/checkov/action.yml:169). The PR body's table and notes still stop at 3.4.3, so I haven't seen release notes for 3.4.4. Only the image tag changes, and the ref is still a tag rather than a digest, same as before. The diff is now 64 files, +70/−70. Each package moves from exactly one old SHA to one new SHA.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect the permission-* inputs at comment-triggered-check/action.yml:197, secret-broker-request/action.yml:37 and fork-review-advisory.yaml:57–59. If any of those inputs was renamed, GitHub only logs a warning and mints the token with the app's full installation permissions instead of the narrower scope. I haven't checked this. Please confirm the inputs still exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so CLAUDE.md calls for a new ai-pr-review major. To get one, add the major-release label before merging. Without the label, the tag workflow moves the existing tag.
  • Checkov 3.3.0 → 3.4.4: a minor bump can add or tighten policies, and 3.4.2 also hardens the defaults for network and credential handling. A caller that doesn't set soft_fail could start failing on IaC that passed before, without changing anything on their side. The checkov tag moves on merge unless the PR has the major-release label.

These haven't changed since the last review and have no problems: claude-code-action (v1.0.271), create-pull-request v8.1.3, setup-helm v5.1.0, docker/login-action v4.8.0 (check that the promote-release smoke job passed), cosign-installer v4.1.3, bats-action 4.1.0, action-actionlint v1.84.0, codeql-action/upload-sarif v4.39.3 (check the first scheduled run), setup-uv v10.3.3 and setup-kubectl v5.2.0.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved by the shared auto-approve workflow because this PR matched the approval criteria.

For more information, see https://github.com/loft-sh/github-actions?tab=readme-ov-file#auto-approve-bot-prs.

@github-actions

github-actions Bot commented Nov 12, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 19s —— View job


Review: PR #291

This push adds no new bugs or security issues. Three issues from earlier reviews are still open.

  • New in this push: .github/workflows/actionlint.yaml moves reviewdog/action-actionlint from v1.84.0 to v1.84.1 (ae857e78…). The PR body has no notes for v1.84.1. The pin is still a full SHA. This workflow only lints this repo, so callers get nothing from it, and if it starts failing, this PR's own CI will show it.
  • The diff is still 64 files, +70/−70. Each package in this group moves from exactly one old SHA to one new SHA.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect the permission-* inputs at comment-triggered-check/action.yml:197, secret-broker-request/action.yml:37 and fork-review-advisory.yaml:57–59. If any of those inputs was renamed, GitHub only logs a warning and mints the token with the app's full installation permissions instead of the narrower scope. I haven't checked this. Please confirm the inputs still exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so CLAUDE.md calls for a new ai-pr-review major. To get one, add the major-release label before merging. Without the label, the tag workflow moves the existing tag.
  • Checkov 3.3.0 → 3.4.4 (checkov/action.yml:169): a minor bump can add or tighten policies, and 3.4.2 also hardens the defaults for network and credential handling. A caller that doesn't set soft_fail could start failing on IaC that passed before, without changing anything on their side. The checkov tag moves on merge unless the PR has the major-release label.

These haven't changed since the last review and have no problems: claude-code-action (v1.0.271), create-pull-request v8.1.3, setup-helm v5.1.0, docker/login-action v4.8.0 (check that the promote-release smoke job passed), cosign-installer v4.1.3, bats-action 4.1.0, codeql-action/upload-sarif v4.39.3 (check the first scheduled run), setup-uv v10.3.3 and setup-kubectl v5.2.0.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved by the shared auto-approve workflow because this PR matched the approval criteria.

For more information, see https://github.com/loft-sh/github-actions?tab=readme-ov-file#auto-approve-bot-prs.

@github-actions

github-actions Bot commented Nov 12, 2026 •

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 22s —— View job


Review: PR #291

This push adds no new bugs or security issues. Three issues from earlier reviews are still open.

New in this push:

  • All four anthropics/claude-code-action pins moved to d5f7970a… (v1.0.272). This review job ran on d5f7970a, so the new pin has run end to end once. The PR body's table still says v1.0.271.
  • Checkov moved to 3.4.5 (checkov/action.yml:169). The PR body's notes stop at 3.4.4, so I haven't seen notes for 3.4.5. Only the image tag changes.
  • I grepped .github/ and found no older claude-code-action pin and no checkov:3.3/3.4.4 left. The diff is still 64 files, +70/−70, and each package moves from exactly one old SHA to one new SHA.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect the permission-* inputs at comment-triggered-check/action.yml:197, secret-broker-request/action.yml:37 and fork-review-advisory.yaml:57–59. If any of those inputs was renamed, GitHub only logs a warning, and the token is created with the app's full installation permissions instead of the narrower scope. I haven't checked this. Please confirm the inputs still exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so CLAUDE.md calls for a new ai-pr-review major. To get one, add the major-release label before merging. Without the label, the tag workflow moves the existing tag.
  • Checkov 3.3.0 → 3.4.5: a minor bump can add or tighten policies, and 3.4.2 also hardens the defaults for network and credential handling. A caller that doesn't set soft_fail could start failing on IaC that passed before, with no change on their side. The checkov tag moves on merge unless the PR has the major-release label.

These haven't changed since the last review and have no problems: create-pull-request v8.1.3, setup-helm v5.1.0, docker/login-action v4.8.0 (check that the promote-release smoke job passed), cosign-installer v4.1.3, bats-action 4.1.0, action-actionlint v1.84.1, codeql-action/upload-sarif v4.39.3 (check the first scheduled run), setup-uv v10.3.3 and setup-kubectl v5.2.0.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved by the shared auto-approve workflow because this PR matched the approval criteria.

For more information, see https://github.com/loft-sh/github-actions?tab=readme-ov-file#auto-approve-bot-prs.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants