chore(deps): bump the actions group across 1 directory with 4 updates - #736
Open
dependabot[bot] wants to merge 2 commits into
Open
chore(deps): bump the actions group across 1 directory with 4 updates#736dependabot[bot] wants to merge 2 commits into
dependabot[bot] wants to merge 2 commits into
Conversation
Bumps the actions group with 4 updates in the / directory: [taiki-e/install-action](https://github.com/taiki-e/install-action), [dawidd6/action-send-mail](https://github.com/dawidd6/action-send-mail), [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog) and [actions/setup-java](https://github.com/actions/setup-java). Updates `taiki-e/install-action` from 2.86.5 to 2.86.7 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@v2.86.5...v2.86.7) Updates `dawidd6/action-send-mail` from 3.12.0 to 18 - [Release notes](https://github.com/dawidd6/action-send-mail/releases) - [Commits](dawidd6/action-send-mail@v3.12.0...v18) Updates `trufflesecurity/trufflehog` from 3.97.0 to 3.97.1 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@v3.97.0...v3.97.1) Updates `actions/setup-java` from 5.7.0 to 6.0.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@v5.7.0...v6.0.0) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.86.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: dawidd6/action-send-mail dependency-version: '18' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: trufflesecurity/trufflehog dependency-version: 3.97.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: actions/setup-java dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
The PR updates multiple GitHub Actions, including significant major version jumps for action-send-mail (v3 to v18) and setup-java (v5 to v6). While the PR is rated as up to standards by Codacy, several actions currently use mutable tags instead of immutable commit SHAs. This lack of pinning presents a supply chain risk, especially for actions handling sensitive SMTP credentials or security scanning. The leap to version 18 for action-send-mail and version 6 for setup-java should be verified for compatibility with existing configurations and inputs.
About this PR
- The upgrade for
dawidd6/action-send-mailfrom v3.12.0 to v18 is a substantial major version jump. Please ensure that all configuration inputs in thepush-email-notify.ymlworkflow remain compatible with this version. - The upgrade to
actions/setup-java@v6.0.0is a major release. Monitor the verification pipeline for any regressions in JRE setup, specifically noting that some inputs have been renamed (though deprecated aliases exist).
Test suggestions
- Verify dawidd6/action-send-mail@v18 successfully sends notification emails with existing SMTP secrets and 'from' address formatting.
- Verify actions/setup-java@v6.0.0 correctly sets up the Eclipse Temurin 21 JRE for TLC model-checking tasks.
- Confirm taiki-e/install-action@v2.86.7 correctly installs cargo-llvm-cov, cargo-deny, and just.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify dawidd6/action-send-mail@v18 successfully sends notification emails with existing SMTP secrets and 'from' address formatting.
2. Verify actions/setup-java@v6.0.0 correctly sets up the Eclipse Temurin 21 JRE for TLC model-checking tasks.
3. Confirm taiki-e/install-action@v2.86.7 correctly installs cargo-llvm-cov, cargo-deny, and just.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| steps: | ||
| - name: Send push notification email | ||
| uses: dawidd6/action-send-mail@v3.12.0 | ||
| uses: dawidd6/action-send-mail@v18 |
There was a problem hiding this comment.
🔴 HIGH RISK
This step handles sensitive SMTP secrets. To protect against credential theft via supply chain compromise, pin the action to a full 40-character commit SHA instead of the v18 tag.
|
|
||
| - name: TruffleHog Secret Scan | ||
| uses: trufflesecurity/trufflehog@v3.97.0 | ||
| uses: trufflesecurity/trufflehog@v3.97.1 |
There was a problem hiding this comment.
🔴 HIGH RISK
Pinning the secret scanner action to a commit SHA is critical. Since this tool actively scans for credentials, ensuring the code being executed is immutable prevents a scenario where a compromised action harvests the very secrets it is intended to detect.
|
|
||
| - name: Install cargo-llvm-cov | ||
| uses: taiki-e/install-action@v2.86.5 | ||
| uses: taiki-e/install-action@v2.86.7 |
There was a problem hiding this comment.
🔴 HIGH RISK
Pinning third-party actions to a specific commit SHA is the only way to guarantee the action's code hasn't been tampered with after the version was released. Tags can be moved by repository owners, whereas a SHA is immutable. For a tool like install-action that fetches binaries, this ensures integrity of the build tools.
Dependabot bumped four actions across six workflows but did not touch actions.lock, so every bumped workflow requested a version its lock entry did not record. This is the estate's recurring startup_failure shape. NOT PREDICTED — MEASURED. Across the last 60 runs repo-wide there were exactly five `startup_failure` conclusions, and all five were on this PR's head sha 1fb498e: Tests, Verify Proofs, CI, Security, Build Gossamer GUI. That is five of the six workflows the PR modified; the sixth (push-email-notify) is push-triggered and does not run on a PR, so the coverage is exact rather than partial. Within-sha control, which is what rules out the alternatives: on the SAME head sha, every workflow the PR did not touch started and passed — Hypatia Security Scan, Secret Scanner, CodeQL, Rust CI, Dogfood Gate, bridge-gate. Same commit, same runner allowlist, same repo policy. Only the modified workflows died at startup, so this is lock drift and not a wiped allowlist. Recorded, with each tag resolved to a real commit and verified to exist: taiki-e/install-action v2.86.5 -> v2.86.7 b6ff580856c41316412a0b9b60540fbc6f8c82cc dawidd6/action-send-mail v3.12.0 -> v18 94de994a9f6fffee200243214e17002e2920bb59 trufflesecurity/trufflehog v3.97.0 -> v3.97.1 20652fbbdefffcdaa493a5bf57ab2ac6b1db715b actions/setup-java v5.7.0 -> v6.0.0 dd06d9cba3e5552c54d9f8ea23572deb30010f7c owner_id/repo_id carried across and cross-checked against the existing entries. Hand-edited rather than regenerated. `gh actions-lock` has a measured history in this estate of rewriting far more files than asked, downgrading a SHA pin to a tag, and inserting its banner above the SPDX header. Eight request lines and four definition blocks changed; the diff contains nothing else. Verified: YAML parses (27 workflows tracked); zero stale references to the four old versions remain; SPDX banner still on line 1. PRE-EXISTING AND NOT ADDRESSED HERE: 16 further `uses:` references have no lock entry (codeql-action sub-paths, actions/cache/{restore,save}, Swatinem/rust-cache, the clusterfuzzlite actions, the hyperpolymath reusable-workflow callers and the two validate-actions). That count was 20 before this change and is 16 after, so this commit reduces the gap rather than adding to it. Worth its own pass. STILL NEEDS AN OWNER DECISION, independent of this fix: action-send-mail v3.12.0 -> v18 is a fifteen-major jump whose input contract may have changed, in a push-triggered workflow no PR check can exercise. Regenerating the lock lets it start; it does not establish that the step still works. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| - name: Install just | ||
| uses: taiki-e/install-action@v2.86.5 | ||
| uses: taiki-e/install-action@v2.86.7 |
|
|
||
| - name: Install cargo-llvm-cov | ||
| uses: taiki-e/install-action@v2.86.5 | ||
| uses: taiki-e/install-action@v2.86.7 |
| steps: | ||
| - name: Send push notification email | ||
| uses: dawidd6/action-send-mail@v3.12.0 | ||
| uses: dawidd6/action-send-mail@v18 |
|
|
||
| - name: Install cargo-deny | ||
| uses: taiki-e/install-action@v2.86.5 | ||
| uses: taiki-e/install-action@v2.86.7 |
|
|
||
| - name: TruffleHog Secret Scan | ||
| uses: trufflesecurity/trufflehog@v3.97.0 | ||
| uses: trufflesecurity/trufflehog@v3.97.1 |
|
|
||
| - name: Install cargo-deny | ||
| uses: taiki-e/install-action@v2.86.5 | ||
| uses: taiki-e/install-action@v2.86.7 |
|
|
||
| - name: TruffleHog Secret Scan | ||
| uses: trufflesecurity/trufflehog@v3.97.0 | ||
| uses: trufflesecurity/trufflehog@v3.97.1 |
|
|
||
| - name: Install cargo-llvm-cov | ||
| uses: taiki-e/install-action@v2.86.5 | ||
| uses: taiki-e/install-action@v2.86.7 |
hyperpolymath
enabled auto-merge (squash)
August 28, 2026 06:00
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 4 updates in the / directory: taiki-e/install-action, dawidd6/action-send-mail, trufflesecurity/trufflehog and actions/setup-java.
Updates
taiki-e/install-actionfrom 2.86.5 to 2.86.7Release notes
Sourced from taiki-e/install-action's releases.
Changelog
Sourced from taiki-e/install-action's changelog.
Commits
b6ff580Release 2.86.7a4b7b62Updatetombi@latestto 1.4.17f5d2c4Updaterafn@latestto 0.1.50223cb3Update mise manifest80434f8Update kingfisher manifest45d93f4Update cargo-zigbuild manifest7754905Updatecargo-binstall@latestto 1.22.06cd1350Release 2.86.60110a1eUpdate tombi manifest48a83f9Update rafn manifestUpdates
dawidd6/action-send-mailfrom 3.12.0 to 18Release notes
Sourced from dawidd6/action-send-mail's releases.
... (truncated)
Commits
94de994fix: Use extended HELLO with github.com domain (#302)6e50282build(deps): bump actions/checkout from 6 to 7 (#300)1d138f3build(deps): bump nodemailer from 9.0.0 to 9.0.1 (#299)1369c5bnode_modules: update (#297)d86d472build(deps): bump nodemailer from 8.0.11 to 9.0.0 (#296)19dc783build(deps): bump nodemailer from 8.0.10 to 8.0.11 (#295)0dd1be8build(deps): bump nodemailer from 8.0.9 to 8.0.10 (#294)6bf8b9cbuild(deps): bump nodemailer from 8.0.8 to 8.0.9 (#293)51e2c0dbuild(deps): bump nodemailer from 8.0.7 to 8.0.8 (#292)076b075build(deps): bump brace-expansion from 5.0.5 to 5.0.6 (#291)Updates
trufflesecurity/trufflehogfrom 3.97.0 to 3.97.1Release notes
Sourced from trufflesecurity/trufflehog's releases.
Commits
20652fbCarry GitHub App installation ID on repo units (#5215)3ab759fRefine SECURITY.md (#5216)2cdb97d[SCAN-101] s3 source accept persisted unit envelopes in UnmarshalSourceUnit (...4ec7749preallocate bindings capacity in dockerhub and groq, with unit tests (#5213)9610306Doubled timeout, as MongoDB secrets are repeatedly hitting this and failing t...9d3f5d1[SCAN-1020] neon scram pgx (#5217)925c1d0fix(detectors/docker): don't greedy match in keyPat (#5214)e12da3cdocs: add generic config-secret custom detector example (#5195)bcbcab2Fix GHEC with Data Residency (*.ghe.com) base URL (#4777)bc3a3aeUpdate module github.com/go-git/go-git/v5 to v5.19.2 [SECURITY] (#5196)Updates
actions/setup-javafrom 5.7.0 to 6.0.0Release notes
Sourced from actions/setup-java's releases.
... (truncated)
Commits
dd06d9cPrepare documentation for v6 release (#1253)59b3450chore(deps): combine open Dependabot npm updates (#1252)b96213dSet default signature verification for supported distributions (#1246)1dbac3cdocs: expose contributing guide to GitHub (#1245)11741d6ci: constrain cache e2e job modes (#1244)ff99aa1Fix Oracle macOS E2E version (#1243)416c6d1Add Red Hat Build of OpenJDK support (#1241)5f75b27Add Maven dependency-resolution repositories (#1240)a42a52cAdd multiple Maven server credentials (#1239)fb4abd7test: cover JDK 26 from SDKMAN (#1238)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions