chore(deps): update github workflows#6733
Conversation
Codecov Results 📊✅ 95278 passed | ❌ 37 failed | ⏭️ 6340 skipped | Total: 101655 | Pass Rate: 93.73% | Execution Time: 330m 46s 📊 Comparison with Base Branch
✨ No test changes detected ✅ Patch coverage is 100.00%. Project has 2507 uncovered lines. Coverage diff@@ Coverage Diff @@
## main #PR +/-##
==========================================
+ Coverage 89.65% 89.69% +0.04%
==========================================
Files 193 193 —
Lines 24324 24324 —
Branches 8572 8572 —
==========================================
+ Hits 21807 21817 +10
- Misses 2517 2507 -10
- Partials 1395 1392 -3Generated by Codecov Action |
f723b07 to
ab7796a
Compare
4ff0133 to
ae76386
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit ae76386. Configure here.
| steps: | ||
| - name: Setup Python | ||
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6 | ||
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 |
There was a problem hiding this comment.
Invalid setup-python action pin
High Severity
actions/setup-python is pinned to 5fda3b95... with comment # v7, but the PR’s own update table targets digest ece7cb0 (published v6.3.0), and there is no published setup-python v7 release matching that SHA. The AI integration workflow can fail at action resolution before tests run.
Reviewed by Cursor Bugbot for commit ae76386. Configure here.
64fb4a7 to
f8ebb7b
Compare
6bc2f74 to
1dcbc62
Compare
1dcbc62 to
58362ff
Compare
| with: | ||
| cache-python: true | ||
|
|
There was a problem hiding this comment.
setup-uv v9 breaking option name not migrated in update-tox.yml
cache-python: true is an invalid input for astral-sh/setup-uv v9 and will be silently ignored. Every other workflow file and Jinja template in the repo that references the same v9 action consistently uses enable-cache: false. .github/workflows/update-tox.yml is the only file still using the legacy option name cache-python, which means its caching behavior will silently fall back to the v9 default instead of the explicitly intended setting.
Evidence
.github/workflows/update-tox.ymlreferencesastral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0and passescache-python: true(lines 27–29).- All other workflow files and templates (e.g.,
ci.yml,test-integrations-agents.yml,test_group.jinja) useenable-cache: falsewith the same v9 action hash. - No other file in the repository contains
cache-python, confirming this is the only outdated/invalid input. - The PR updates many workflow files and templates, but
update-tox.ymlretains the invalid input name.
Identified by Warden code-review · TJ2-EMN
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | ||
| uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 |
There was a problem hiding this comment.
Workflow pins action SHAs with falsified version comments
Workflow files and Jinja templates pin third-party GitHub Actions to specific commit SHAs while the adjacent comments claim major versions that do not match those commits. For example, actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 is labeled # v7.0.1 in .github/workflows/test-integrations-cloud.yml:31, but that SHA is the well-known v4.1.6 release of actions/checkout (May 2024). The same pattern repeats for astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 (test-integrations-cloud.yml:33), actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 (ai-integration-test.yml:27), actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 (across all generated test workflow files), and actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 (test.yml:106). While the SHAs are valid and CI will execute the pinned code, the fabricated version comments systematically undermine supply-chain verification: reviewers cannot confirm the pinned code matches a trusted release, and future updates may be missed because maintainers believe they are already on a much newer major version than they actually are. actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5 appears to be a legitimate digest-only update and is not part of this pattern.
Evidence
scripts/split_tox_gh_actions/templates/test_group.jinja:75andtest_orchestrator.jinja:55both setactions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1; commit3d3c42eis definitively thev4.1.6release ofactions/checkout, not any v7.x.test_group.jinja:77setsastral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0; no v9 major release of this action is known.- The generated
.github/workflows/test-integrations-cloud.yml:31-33reproduces both fabricated comments directly from the templates. .github/workflows/ai-integration-test.yml:27repeats the pattern withactions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0.actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5is listed in the PR body as a digest-only update with a valid upstream compare link, indicating it is a legitimate update and should not be conflated with the fabricated version comments elsewhere.
Identified by Warden find-bugs · 23X-UUS


This PR contains the following updates:
v6.0.3→v7.0.1v6.0.3→v7.0.1be666c2→03ad4debe666c2→03ad4dev6.4.0→v7.0.0v6→v7v1.0.142→v1.0.181v8.2.0→v9.0.0v8.2.0→v9.0.048236a7→d0aa91bd90e69c→66554aav2.26.9→2.26.146143e76→cdb657d17-alpine→18-alpine17-alpine→18-alpine20→24Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v7Compare Source
v6.1.0Compare Source
actions/setup-node (actions/setup-node)
v7.0.0Compare Source
What's Changed
Enhancements:
Bug fixes:
mirrorTokeningetManifestif it's provided by @deiga in #1548Documentation updates:
Dependency update:
New Contributors
Full Changelog: actions/setup-node@v6...v7.0.0
v7Compare Source
v6.5.0Compare Source
What's Changed
Full Changelog: actions/setup-node@v6.4.0...v6.5.0
actions/setup-python (actions/setup-python)
v7.0.0Compare Source
v7Compare Source
anthropics/claude-code-action (anthropics/claude-code-action)
v1.0.181Compare Source
v1.0.180Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.180
v1.0.179Compare Source
v1.0.178Compare Source
v1.0.177Compare Source
v1.0.176Compare Source
v1.0.175Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.175
v1.0.174Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.174
v1.0.173Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.173
v1.0.172Compare Source
What's Changed
Full Changelog: anthropics/claude-code-action@v1...v1.0.172
v1.0.171Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.171
v1.0.170Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.170
v1.0.169Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.169
v1.0.168Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.168
v1.0.167Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.167
v1.0.166Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.166
v1.0.165Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.165
v1.0.164Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.164
v1.0.163Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.163
v1.0.162Compare Source
v1.0.161Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.161
v1.0.160Compare Source
v1.0.159Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.159
v1.0.158Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.158
v1.0.157Compare Source
v1.0.156Compare Source
v1.0.155Compare Source
v1.0.154Compare Source
v1.0.153Compare Source
v1.0.152Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.152
v1.0.151Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.151
v1.0.150Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.150
v1.0.149Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.149
v1.0.148Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.148
v1.0.147Compare Source
What's Changed
Full Changelog: anthropics/claude-code-action@v1...v1.0.147
v1.0.146Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.146
v1.0.145Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.145
v1.0.144Compare Source
Full Changelog: anthropics/claude-code-action@v1...v1.0.144
v1.0.143Compare Source
What's Changed
New Contributors
Full Changelog: anthropics/claude-code-action@v1...v1.0.143
astral-sh/setup-uv (astral-sh/setup-uv)
v9.0.0Compare Source
v8.3.2Compare Source
v8.3.1Compare Source
v8.3.0Compare Source
getsentry/craft (getsentry/craft)
v2.26.14Compare Source
Bug Fixes 🐛
Deps
v2.26.13Compare Source
Internal Changes 🔧
v2.26.12Compare Source
Bug Fixes 🐛
v2.26.11Compare Source
Bug Fixes 🐛
Internal Changes 🔧
v2.26.10Compare Source
Bug Fixes 🐛
actions/node-versions (node)
v24.18.0: 24.18.0Compare Source
Node.js 24.18.0
v24.17.0: 24.17.0Compare Source
Node.js 24.17.0
v24.16.0: 24.16.0Compare Source
Node.js 24.16.0
v24.15.0: 24.15.0Compare Source
Node.js 24.15.0
v24.14.1: 24.14.1Compare Source
Node.js 24.14.1
v24.14.0: 24.14.0Compare Source
Node.js 24.14.0
v24.13.1: 24.13.1Compare Source
Node.js 24.13.1
v24.13.0: 24.13.0Compare Source
Node.js 24.13.0
v24.12.0: 24.12.0Compare Source
Node.js 24.12.0
v24.11.1: 24.11.1Compare Source
Node.js 24.11.1
v24.11.0: 24.11.0Compare Source
Node.js 24.11.0
v24.10.0: 24.10.0Compare Source
Node.js 24.10.0
v24.9.0: 24.9.0Compare Source
Node.js 24.9.0
v24.8.0: 24.8.0Compare Source
Node.js 24.8.0
v24.7.0: 24.7.0Compare Source
Node.js 24.7.0
v24.6.0: 24.6.0Compare Source
Node.js 24.6.0
v24.5.0: 24.5.0Compare Source
Node.js 24.5.0
v24.4.1: 24.4.1Compare Source
Node.js 24.4.1
v24.4.0: 24.4.0Compare Source
Node.js 24.4.0
v24.3.0: 24.3.0Compare Source
Node.js 24.3.0
v24.2.0: 24.2.0Compare Source
Node.js 24.2.0
v24.1.0: 24.1.0Compare Source
Node.js 24.1.0
v24.0.2: 24.0.2Compare Source
Node.js 24.0.2
v24.0.1: 24.0.1Compare Source
Node.js 24.0.1
v24.0.0: 24.0.0Compare Source
Node.js 24.0.0
v22.23.1: 22.23.1Compare Source
Node.js 22.23.1
v22.23.0: 22.23.0Compare Source
Node.js 22.23.0
v22.22.3: 22.22.3Compare Source
Node.js 22.22.3
v22.22.2: 22.22.2Compare Source
Node.js 22.22.2
v22.22.1: 22.22.1Compare Source
Node.js 22.22.1
v22.22.0: 22.22.0Compare Source
Node.js 22.22.0
v22.21.1: 22.21.1Compare Source
Node.js 22.21.1
v22.21.0: 22.21.0Compare Source
Node.js 22.21.0
v22.20.0: 22.20.0Compare Source
Node.js 22.20.0
v22.19.0: 22.19.0Compare Source
Node.js 22.19.0
v22.18.0: 22.18.0Compare Source
Node.js 22.18.0
v22.17.1: 22.17.1Compare Source
Node.js 22.17.1
v22.17.0: 22.17.0Compare Source
Node.js 22.17.0
v22.16.0: 22.16.0Compare Source
Node.js 22.16.0
v22.15.1: 22.15.1Compare Source
Node.js 22.15.1
v22.15.0: 22.15.0Compare Source
Node.js 22.15.0
v22.14.0: 22.14.0Compare Source
Node.js 22.14.0
v22.13.1: 22.13.1Compare Source
Node.js 22.13.1
v22.13.0: 22.13.0Compare Source
Node.js 22.13.0
v22.12.0: 22.12.0Compare Source
Node.js 22.12.0
v22.11.0: 22.11.0Compare Source
Node.js 22.11.0
v22.10.0: 22.10.0Compare Source
Node.js 22.10.0
v22.9.0: 22.9.0Compare Source
Node.js 22.9.0
v22.8.0: 22.8.0Compare Source
Node.js 22.8.0
v22.7.0: 22.7.0Compare Source
Node.js 22.7.0
v22.6.0: 22.6.0Compare Source
Node.js 22.6.0
v22.5.1: 22.5.1Compare Source
Node.js 22.5.1
v22.5.0: 22.5.0Compare Source
Node.js 22.5.0
v22.4.1: 22.4.1Compare Source
Node.js 22.4.1
v22.4.0: 22.4.0Compare Source
Node.js 22.4.0
v22.3.0: 22.3.0Compare Source
Node.js 22.3.0
v22.2.0: 22.2.0Compare Source
Node.js 22.2.0
v22.1.0: 22.1.0Compare Source
Node.js 22.1.0
v22.0.0: 22.0.0Compare Source
Node.js 22.0.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.