Skip to content

chore(deps): update github-actions - #291

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions
Open

chore(deps): update github-actions#291
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions

Conversation

@renovate

@renovate renovate Bot commented Sep 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
actions/create-github-app-token (changelog) action digest bcd2ba4 → 64ab729
actions/create-github-app-token action minor v3.2.0 → v3.3.0
anthropics/claude-code-action (changelog) action digest 8cf3482 → d70510b
anthropics/claude-code-action action patch v1.0.233 → v1.0.264
astral-sh/setup-uv action minor v10.2.0 → v10.3.3
azure/setup-kubectl action minor v5.1.0 → v5.2.0
docker/login-action action minor v4.6.0 → v4.7.0
ghcr.io/bridgecrewio/checkov docker minor 3.3.0 → 3.4.0
github/codeql-action action minor v4.38.1 → v4.39.1
loft-sh/github-actions (changelog) action digest c6a76f1 → d15a1df
openai/codex-action action minor v1.12 → v1.13
reviewdog/action-actionlint action minor v1.77.0 → v1.81.0

Release Notes

actions/create-github-app-token

v3.3.0

Compare Source

Features
Bug Fixes
  • deps: bump nested undici from 6.24.0 to 6.29.0 (#​403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#​395) (a69c19d)
anthropics/claude-code-action

v1.0.264

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1.0.263...v1.0.264

v1.0.263

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.262...v1.0.263

v1.0.262

Compare Source

What's Changed

New Contributors

Full Changelog: anthropics/claude-code-action@v1.0.261...v1.0.262

v1.0.261

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.260...v1.0.261

v1.0.260

Compare Source

What's Changed

Full Changelog: anthropics/claude-code-action@v1.0.259...v1.0.260

v1.0.259

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.258...v1.0.259

v1.0.258

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.257...v1.0.258

v1.0.257

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.256...v1.0.257

v1.0.256

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.255...v1.0.256

v1.0.255

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.254...v1.0.255

v1.0.254

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.253...v1.0.254

v1.0.253

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.252...v1.0.253

v1.0.252

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.251...v1.0.252

v1.0.251

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.250...v1.0.251

v1.0.250

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.249...v1.0.250

v1.0.249

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.248...v1.0.249

v1.0.248

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.247...v1.0.248

v1.0.247

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.246...v1.0.247

v1.0.246

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.245...v1.0.246

v1.0.245

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.244...v1.0.245

v1.0.244

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.243...v1.0.244

v1.0.243

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.242...v1.0.243

v1.0.242

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.241...v1.0.242

v1.0.241

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.240...v1.0.241

v1.0.240

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.239...v1.0.240

v1.0.239

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.238...v1.0.239

v1.0.238

Compare Source

What's Changed
New Contributors

Full Changelog: anthropics/claude-code-action@v1.0.237...v1.0.238

v1.0.237

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.236...v1.0.237

v1.0.236

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.235...v1.0.236

v1.0.235

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.234...v1.0.235

v1.0.234

Compare Source

Full Changelog: anthropics/claude-code-action@v1.0.233...v1.0.234

astral-sh/setup-uv

v10.3.3: 🌈 Use Astral mirror for version manifests with GitHub fallback

Compare Source

Changes

This release contains something that should have been included a very long time ago. Sorry for sleeping on that.

This action now retrieves the release manifest that contains the available versions, their download links and checksums from the Astral mirror, rather than trying GitHub first. This should present much more stable.
(Known checksums are still checked, so the security impact does not change)

Also a big thank you to @​soujasK for a set of bugfixes 👏

🐛 Bug fixes
🧰 Maintenance
📚 Documentation

v10.3.2: 🌈 update known checksums for 0.13.5

Compare Source

Changes

🧰 Maintenance

📚 Documentation

v10.3.1: 🌈 preserve cache error class names in save-cache bundle

Compare Source

Changes

This release includes a fix so that multiple concurrent workflows trying to upload the same cache no longer warn

##[warning]Failed to save: Unable to reserve cache with key ..., another job may be creating this cache.

🐛 Bug fixes
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v10.3.0: 🌈 Add Python architecture selection

Compare Source

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

azure/setup-kubectl

v5.2.0

Compare Source

Added
Fixed
Changed
Security
docker/login-action

v4.7.0

Compare Source

Full Changelog: docker/login-action@v4.6.0...v4.7.0

bridgecrewio/checkov (ghcr.io/bridgecrewio/checkov)

v3.4.0

Compare Source

  • no noteworthy changes

v3.3.30

Compare Source

Bug Fix

  • secrets: load platform-provided detectors in spawn-mode secrets … - #​7757

v3.3.29

Compare Source

v3.3.28

Compare Source

Bug Fix

  • terraform: resolve graph edges for count/for_each indexed resource references - #​7736

v3.3.27

Compare Source

Bug Fix

  • secrets: detect paired AWS secret in bare CSV/delimited format - #​7734

v3.3.26

Compare Source

Bug Fix

  • terraform_plan: resolve for_each module calls in plan parser - #​7723

v3.3.24

Compare Source

v3.3.23

Compare Source

Bug Fix

  • sca: apply --skip-path regex and hidden-dir filtering to sca_package - #​7712

v3.3.22

Compare Source

v3.3.21

Compare Source

Bug Fix

  • terraform_json: handle HCL JSON array and single-dict block formats in parser - #​7707

v3.3.20

Compare Source

Bug Fix

  • terraform_plan: skip resources being removed from state ('forget' action) - #​7676

v3.3.19

Compare Source

Feature

  • terraform: add CKV_AWS_394 for unconstrained aws_availability_zones data source - #​7658

v3.3.18

Compare Source

v3.3.17

Compare Source

Bug Fix

  • general: honour scope.provider for platform-downloaded custom po… - #​7677

v3.3.16

Compare Source

Bug Fix

  • terraform: Added current Azure Terraform resources and taggable resources as of hashicorp/azurerm provider version 4.81 - #​7652

v3.3.15

Compare Source

Bug Fix

  • sca: match CVE suppressions case-insensitively - #​7659
  • sca: match CvesAccounts suppressions on unprefixed account ids - #​7660

v3.3.14

Compare Source

v3.3.13

Compare Source

Bug Fix

  • kubernetes: Fix K8S suppressions annotations - #​7651

v3.3.12

Compare Source

Bug Fix

  • sca: correct Windows path handling in image referencer - #​7650

v3.3.11

Compare Source

v3.3.10

Compare Source

v3.3.9

Compare Source

Bug Fix

  • terraform: handle null container_properties in aws_batch_job_def… - #​7636

v3.3.8

Compare Source

Bug Fix

  • kubernetes: CKV_K8S_40 should pass when hostUsers is false - #​7580

v3.3.7

Compare Source

Feature

  • general: fix github only output for sca - #​7598

v3.3.6

Compare Source

Bug Fix

  • terraform: prevent crash in S3AllowsAnyPrincipal with unparsed v… - #​7581

v3.3.5

Compare Source

Feature

  • general: fix danger node version - #​7589

Bug Fix

  • general: retry kustomize/helm install to survive transient GitHub failures - #​7591
  • terraform: CKV_AZURE_190 override singular get_expected_value - #​7592

v3.3.4

Compare Source

v3.3.3

Compare Source

v3.3.2

Compare Source

Bug Fix

  • terraform_plan: handle computed log_bucket in CKV_GCP_62 and CKV_GCP_63 - #​7582
  • terraform: pass CKV_GCP_123 when remove_default_node_pool is true - #​7575

v3.3.1

Compare Source

Feature

  • serverless: disable vars opt out - #​7574
github/codeql-action

v4.39.1

Compare Source

v4.39.0

Compare Source

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198

v4.38.3

Compare Source

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4188
  • Update default CodeQL bundle version to 2.27.2. #​4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #​4184

v4.38.2

Compare Source

openai/codex-action

v1.13

Compare Source

  • #​183 preserve system service access when restricting runner sockets under Linux drop-sudo.
  • Bound output draining to five seconds after Codex exits so descendants retaining log streams cannot keep the action open.
  • Linux drop-sudo now requires setfacl (the acl package) and ACL support on /run.
reviewdog/action-actionlint

v1.81.0

Compare Source

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.80.8...v1.81.0

v1.80.8

Compare Source

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.80.7...v1.80.8

v1.80.7

Compare Source

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.80.6...v1.80.7

v1.80.6

Compare Source

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.80.5...v1.80.6

v1.80.5

Compare Source

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.80.4...v1.80.5

v1.80.4

Compare Source

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.80.3...v1.80.4

v1.80.3

Compare Source

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.80.2...v1.80.3

v1.80.2

Compare Source

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.80.1...v1.80.2

v1.80.1

Compare Source

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.80.0...v1.80.1

v1.80.0

Compare Source

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.79.1...v1.80.0

v1.79.1

Compare Source

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.79.0...v1.79.1

v1.79.0

Compare Source

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.78.1...v1.79.0

v1.78.1

Compare Source

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.78.0...v1.78.1

v1.78.0

Compare Source

What's Changed

Full Changelog: reviewdog/action-actionlint@v1.77.0...v1.78.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner September 24, 2026 21:22
@github-actions

github-actions Bot commented Sep 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 16s —— View job

Review: PR #291

I found no bugs, security issues or performance problems.

  • The same full-length SHA pin (9171db3e…) is applied to all four places that use it. No copy of the old digest (8cf3482) is left anywhere in the repo, so none of the pins is out of step.
  • The pins stay on full commit SHAs, and the existing zizmor: ignore annotations are unchanged.
  • Upstream's v1.0.234 release has no notes. From what's in the PR, it looks like a plain patch bump with no new inputs or permissions.

Release note: .github/actions/ai-pr-review is a shared composite action. Callers get this bump only after its floating tag is moved to the merge commit (see the Release Process section in CLAUDE.md). The change asks nothing new of callers, so moving the existing tag is fine.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 754b98d to 9f43891 Compare September 25, 2026 11:16
@github-actions

github-actions Bot commented Sep 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 18s —— View job

Review: PR #291

I found no bugs, security issues or performance problems.

  • All four uses of anthropics/claude-code-action now point at the same full commit SHA (9171db3e…). The old SHA (8cf3482) no longer appears anywhere in the repo's YAML.
  • actions/checkout goes to v6.1.0 (d23441a4…) in test-platform-release.yaml. That file was the last workflow still pinned to v6. Every other workflow and composite action is on v7.0.1, so this bump leaves nothing behind. Some README examples still say v6.0.2, but that is documentation and changes nothing at runtime.
  • The pins are still full commit SHAs, and the zizmor: ignore annotations are unchanged.

Release note: .github/actions/ai-pr-review is a shared composite action. Merging this PR does not reach its callers until the action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). The bump asks nothing new of callers, so it is fine to move the existing tag rather than cut a new major.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 9f43891 to f34ea1b Compare September 25, 2026 11:29
@github-actions

github-actions Bot commented Sep 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 16s —— View job

Review: PR #291

I found no bugs, security issues or performance problems.

  • All four uses of anthropics/claude-code-action now point at the same full commit SHA (9171db3e…). The old SHA (8cf3482) no longer appears anywhere under .github/.
  • The actions/checkout change that the previous review covered is no longer in this PR. That is expected: test-platform-release.yaml is already on v7.0.1 on main (from chore(deps): update actions/checkout action to v7 #292), so the rebase dropped it.
  • The pins are still full commit SHAs, and the zizmor: ignore annotations are unchanged.

Release note: .github/actions/ai-pr-review is a shared composite action. Merging this PR does not reach its callers until the action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). The bump asks nothing new of callers, so it is fine to move the existing tag rather than cut a new major.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from f34ea1b to 575b401 Compare September 25, 2026 22:17
@github-actions

github-actions Bot commented Sep 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 14s —— View job

Review: PR #291

I found no bugs, security issues or performance problems.

  • Renovate has pushed a new commit. All four uses of anthropics/claude-code-action now point at 756cc22e… (v1.0.235). The earlier reviews on this PR checked the previous pin, 9171db3e…. Neither the old digest (8cf3482) nor 9171db3e appears anywhere under .github/, so no pin is out of step with the others.
  • The pins are still full commit SHAs, and the zizmor: ignore annotations are unchanged.
  • Upstream's v1.0.234 and v1.0.235 releases have no notes. The changed lines only move the SHA; no inputs or permissions change.

Release note: .github/actions/ai-pr-review is a shared composite action. Merging this PR does not reach its callers until the action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). The bump asks nothing new of callers, so moving the existing tag is fine.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 575b401 to ab878b6 Compare September 28, 2026 19:18
@github-actions

github-actions Bot commented Sep 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 13s —— View job

Review: PR #291

I found no bugs, security issues or performance problems.

  • Renovate pushed a new commit. All four uses of anthropics/claude-code-action now point at 8ce9314f… (v1.0.236). The earlier reviews on this PR checked older pins. No other claude-code-action pin is left under .github/, so none of the pins is out of step.
  • The pins are still full commit SHAs, and the zizmor: ignore annotations are unchanged.
  • Upstream's v1.0.234–v1.0.236 releases have no notes. The changed lines only move the SHA; no inputs or permissions change.

Release note: .github/actions/ai-pr-review is a shared composite action. Merging this PR does not reach its callers until the action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). The bump asks nothing new of callers, so moving the existing tag is fine.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from ab878b6 to a5f62aa Compare September 29, 2026 20:10
@github-actions

github-actions Bot commented Sep 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 18s —— View job

Review: PR #291

I found no bugs, security issues or performance problems.

  • Renovate pushed a new commit. All four uses of anthropics/claude-code-action now point at fd1c1286… (v1.0.237). No other claude-code-action pin is left under .github/, so none of the pins is out of step.
  • The pins are still full commit SHAs, and the zizmor: ignore annotations are unchanged.
  • Upstream's v1.0.234–v1.0.237 releases have no notes. The changed lines only move the SHA; no inputs or permissions change.

Release note: .github/actions/ai-pr-review is a shared composite action. Merging this PR does not reach its callers until the action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). The bump asks nothing new of callers, so moving the existing tag is fine.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from a5f62aa to b05e956 Compare September 29, 2026 21:16
@github-actions

github-actions Bot commented Sep 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 28s —— View job

Review: PR #291

I found no bugs, security issues or performance problems.

Release note: ai-pr-review and govulncheck are both shared composite actions. Merging this PR does not reach their callers until each action's floating tag is moved to the merge commit (see the Release Process section of CLAUDE.md). Neither bump asks anything new of callers, so moving the existing tags is fine and no new major is needed.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from b05e956 to 1757163 Compare September 30, 2026 19:26
@github-actions

github-actions Bot commented Sep 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 22s —— View job

Review: PR #291

I found no bugs, security issues or performance problems.

  • Renovate pushed a new commit. All four uses of anthropics/claude-code-action now point at 12dd8d74… (v1.0.238), and no older pin is left under .github/. The pins are still full commit SHAs, and the zizmor: ignore annotations haven't changed.
  • The ci-test-notify bump in .github/actions/govulncheck/action.yml:91 (c6a76f1 → e9b507c, feat(ci-test-notify): add info status and none run link position #298) is the same as in the last review. feat(ci-test-notify): add info status and none run link position #298 only adds an info status and a run-link-position: none option. govulncheck sends status: failure with the default link position, so its Slack message is unchanged.
  • Upstream's v1.0.234–v1.0.238 releases have no notes. The changed lines only move the SHA, and no inputs or permissions change.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see the Release Process section in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 1757163 to 494017c Compare October 1, 2026 08:25
@github-actions

github-actions Bot commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 16s —— View job

Review: PR #291

I found no bugs, security issues or performance problems.

  • New in this push: .github/workflows/actionlint.yaml:38 moves reviewdog/action-actionlint from v1.77.0 to v1.78.0 (1129829f…). Upstream's release notes list only dependency bumps (actions-create-release, pyflakes). No inputs change, and the github_token and reporter inputs it passes stay the same.
  • All four uses of anthropics/claude-code-action still point at 12dd8d74… (v1.0.238), and no older pin is left under .github/. The pins are still full commit SHAs, and the zizmor: ignore annotations haven't changed.
  • The ci-test-notify bump in govulncheck/action.yml:91 (c6a76f1 → e9b507c, feat(ci-test-notify): add info status and none run link position #298) hasn't changed since the last review. Its Slack message stays the same.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see Release Process in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 494017c to de210f3 Compare October 1, 2026 18:03
@github-actions

github-actions Bot commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 49s —— View job

Review: PR #291

Bug: this push rolls cve-scan back to an older ci-test-notify, which undoes #300

.github/actions/cve-scan/action.yml:167 and :197 change the ci-test-notify pin from 2c8ba9b to e9b507c. That is a downgrade: e9b507c is an ancestor of 2c8ba9b, and the only change between the two commits is #299, which added the footer-text input.

cve-scan passes that input at :185 and :220 (footer-text: "View run #…"). At e9b507c the input doesn't exist, so:

Likely cause: the # ci-test-notify/v1 tag comment. Renovate pins each SHA to whatever the tag points at, so the floating tag probably still points at e9b507c, which means it wasn't moved after #299 merged (pin drift). I couldn't confirm this: git ls-remote needed an approval I don't have.

Fix (pick one):

  • Advance the tag to a commit that includes feat(ci-test-notify): let callers set the footer link text #299, e.g. git tag -f ci-test-notify/v1 origin/main && git push origin ci-test-notify/v1 --force. Then have Renovate rebase, and it will re-pin all ci-test-notify uses forward.
  • Or revert the two cve-scan lines in this PR to 2c8ba9b4c4be9e873fac4898cfb4ea2eddb5faed.

Advancing the tag is safe. #299 only adds an optional input, so it asks nothing new of callers.

Fix this →

Everything else is unchanged since the last review and has no problems: the claude-code-action pins on 12dd8d74… (v1.0.238), the govulncheck ci-test-notify bump (c6a76f1 → e9b507c is forward, and govulncheck doesn't use footer-text), and action-actionlint v1.78.0.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from de210f3 to dbe7115 Compare October 1, 2026 19:17
@github-actions

github-actions Bot commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 20s —— View job

Review: PR #291

I found no bugs, security issues or performance problems.

  • The cve-scan downgrade from the last review is fixed. cve-scan/action.yml is no longer in the diff, and both of its ci-test-notify pins stay on 2c8ba9b (feat(ci-test-notify): let callers set the footer link text #299, which has footer-text). The notification_pins.bats guard expects exactly that SHA.
  • govulncheck/action.yml:91 now moves ci-test-notify from c6a76f1 to 2c8ba9b. That is forward: c6a76f1 is an ancestor of 2c8ba9b. The only commits in between are feat(ci-test-notify): add info status and none run link position #298 and feat(ci-test-notify): let callers set the footer link text #299, and both just add optional inputs. govulncheck uses neither, so its Slack message is unchanged.
  • All four uses of anthropics/claude-code-action now point at 97c53473… (v1.0.239), and no older pin is left under .github/. The pins are still full commit SHAs, and the zizmor: ignore annotations haven't changed.
  • reviewdog/action-actionlint v1.78.0 is the same as in the last review: upstream only bumped dependencies.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see Release Process in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from dbe7115 to f23c484 Compare October 2, 2026 06:17
@github-actions

github-actions Bot commented Oct 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 21s —— View job

Review: PR #291

I found no bugs, security issues or performance problems.

  • New in this push: .github/workflows/actionlint.yaml:38 moves reviewdog/action-actionlint from v1.78.0 to v1.78.1 (13465d02…). Upstream's only change is a bump of the Python docker tag to 3.14.8. The inputs stay the same, and this workflow still passes the same github_token and reporter.
  • All four uses of anthropics/claude-code-action still point at 97c53473… (v1.0.239), and no older pin is left under .github/. The pins are still full commit SHAs, and the zizmor: ignore annotations haven't changed.
  • govulncheck/action.yml:91 still moves ci-test-notify forward from c6a76f1 to 2c8ba9b, the same as in the last review. Both cve-scan pins stay on 2c8ba9b, so the downgrade flagged two reviews ago has not come back.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see Release Process in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from f23c484 to cd3f913 Compare October 2, 2026 20:37
@github-actions

github-actions Bot commented Oct 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 52s —— View job

Review: PR #291

Bug: this push rolls cve-scan back to a ci-test-notify that breaks on jq 1.6, undoing #303

.github/actions/cve-scan/action.yml:167 and :197 change the pin from d15a1df (on main since #303) to 2c8ba9b. That is a downgrade, because 2c8ba9b is an ancestor of d15a1df. The only ci-test-notify change between the two is #302. It added the else . branch to SLACK_ESCAPE_CHARS in build-payload.sh:23–24.

  • jq 1.6 rejects an if … elif … end that has no else. jq 1.6 is the version on ubuntu-22.04, where the scheduled scans run.
  • cve-scan passes footer-text (:185, :220), and that input sends the footer through the broken filter (build-payload.sh:115, :119). On 22.04 the jq call fails, so no payload is built. The step is advisory, so the Slack alert for a found CVE or a scanner error is dropped and nothing goes red.
  • .github/actions/cve-scan/test/notification_pins.bats:8 expects exactly d15a1df, so make test fails on this branch.

Likely cause: pin drift again, like the earlier e9b507c rollback on this PR. Renovate re-pins to whatever ci-test-notify/v1 points at, and that tag apparently still points at 2c8ba9b. It wasn't moved after #302 merged. I couldn't check this myself because git fetch/ls-remote needs approval I don't have.

Fix (pick one):

  • Advance the tag: git tag -f ci-test-notify/v1 d15a1df8ea70c58cf70343f7c3687a6014ed63f8 && git push origin ci-test-notify/v1 --force, then tick Renovate's rebase box. This is safe because fix(ci-test-notify): add the else branch jq 1.6 needs in the footer escape #302 is a pure bug fix and asks nothing new of callers.
  • Or revert the two cve-scan lines in this PR to d15a1df8ea70c58cf70343f7c3687a6014ed63f8.

Fix this →

govulncheck is fine. govulncheck/action.yml:91 moves from c6a76f1 to 2c8ba9b, which is forward. govulncheck doesn't pass footer-text, so it never runs the broken filter. Once the tag is advanced, Renovate will move it to d15a1df as well.

Nothing else changed since the last review: claude-code-action is on 97c53473… (v1.0.239) in all four places, and action-actionlint is on v1.78.1.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from cd3f913 to 0a8dec2 Compare October 2, 2026 21:17
@github-actions

github-actions Bot commented Oct 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 22s —— View job

Review: PR #291

I found no bugs, security issues or performance problems.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see Release Process in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 0a8dec2 to 499e299 Compare October 4, 2026 00:16
@github-actions

github-actions Bot commented Oct 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 14s —— View job

Review: PR #291

I found no bugs, security issues or performance problems.

  • New in this push: all four uses of anthropics/claude-code-action now point at cab360f6… (v1.0.241). No older pin is left under .github/. The pins are still full commit SHAs, and the zizmor: ignore annotations haven't changed. Upstream's v1.0.239–v1.0.241 releases have no notes. The changed lines only move the SHA, and no inputs or permissions change.
  • govulncheck/action.yml:91 still moves ci-test-notify forward from c6a76f1 to d15a1df. That matches both cve-scan pins (:167, :197), which are not in the diff, so the downgrade flagged in earlier reviews has not come back.
  • reviewdog/action-actionlint v1.78.1 is the same as in the last review.

Release note: ai-pr-review and govulncheck are shared composite actions. Their callers won't get this bump until each action's floating tag is moved to the merge commit (see Release Process in CLAUDE.md). Neither bump asks anything new of callers, so you can move the existing tags. No new major is needed.

@github-actions

github-actions Bot commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 22s —— View job

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

  • New in this push: Renovate rebased onto fix(backport): link backport prs from multi-commit sources #328 (backport), and astral-sh/setup-uv moves from v10.3.1 to v10.3.2 (07a047e6…) in all five test workflows. Upstream only updated known checksums for uv 0.13.5. None of the steps pass inputs, and the pin is still a full SHA. None of this group's old digests are left under .github/.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:197) and permission-members (secret-broker-request/action.yml:37). If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I still can't check this from the job. Please confirm both inputs exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement. Under the Release Process section of CLAUDE.md, it calls for a new ai-pr-review major, unless every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems: claude-code-action on 6b6870e6… (v1.0.258) in all four places, action-actionlint v1.80.5, setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df, the same commit both cve-scan pins use.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 936a9d2 to 3703b91 Compare October 23, 2026 02:29
@github-actions

github-actions Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 21s —— View job

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

  • New in this push:
    • All four anthropics/claude-code-action pins now point at ae68417a… (v1.0.259). No older pin from this group is left under .github/. The pins are still full commit SHAs, and this review job ran on ae68417a. The PR body's table still says v1.0.258.
    • .github/workflows/actionlint.yaml:38 moves reviewdog/action-actionlint to v1.80.6 (48e36f54…). The PR body has no notes for it. Every earlier release in this range only bumped dependencies, and the workflow passes the same inputs as before.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:197) and permission-members (secret-broker-request/action.yml:37). If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I still haven't been able to check this from the job. Please confirm both inputs exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement. Under the Release Process section of CLAUDE.md, it calls for a new ai-pr-review major, unless every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems: setup-uv v10.3.2 (only in test workflows), setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df, the same commit both cve-scan pins use.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 3703b91 to a25ea64 Compare October 23, 2026 17:30
@github-actions

github-actions Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 30s —— View job

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

New in this push:

  • docker/login-action v4.6.0 → v4.7.0 (81c6f93d…) in cve-scan/action.yml:121 and promote-release/action.yml:141, :154. All three steps use the single-registry form (registry/username/password). The v4.7.0 changes are to registry-auth, ECR, scoped credentials and Docker Hub OIDC, and none of these steps use any of them. They still write the same ghcr.io entry in ~/.docker/config.json, so the crane-before-login ordering that promote-release depends on, and the username check in its smoke job, are unaffected. The comment at cve-scan/action.yml:107 says setSecret only runs on registry-auth; that is still why cve-scan masks the password itself, so the explicit mask step should stay.
  • All four anthropics/claude-code-action pins now point at 8d70a0dd… (v1.0.260), and no older pin from this group is left under .github/. This review job ran on 8d70a0dd.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:197) and permission-members (secret-broker-request/action.yml:37). If either was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I still can't check this from the job. Please confirm both inputs exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major, unless every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems: action-actionlint v1.80.6, setup-uv v10.3.2 (only in test workflows), setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df.

Release note: cve-scan and promote-release are now in this PR too. The login-action bump asks nothing new of their callers, so you can move their existing tags after merge.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from a25ea64 to c3a4fae Compare October 24, 2026 01:46
@github-actions

github-actions Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 30s —— View job

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

  • New in this push: all four anthropics/claude-code-action pins now point at 16f9f71a… (v1.0.261), and no older pin from this group is left under .github/. This review job ran on 16f9f71a, so the new pin has run end to end once. Upstream published no notes for v1.0.261. v1.0.260 (#1915, "pin the PR version a run checks out") changes nothing in how these workflows call the action.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:197) and permission-members (secret-broker-request/action.yml:37). If either was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I still can't check this from the job: there's no local copy of the action, and fetching it needs approval I don't have. Please confirm both inputs exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major, unless every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems: docker/login-action v4.7.0 (cve-scan, promote-release), action-actionlint v1.80.6, setup-uv v10.3.2 (only in test workflows), setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from c3a4fae to ef71307 Compare October 24, 2026 21:11
@github-actions

github-actions Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 18s —— View job

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

  • New in this push: all four anthropics/claude-code-action pins moved to 925afb53… (v1.0.262), and every claude-code-action pin under .github/ is now on that SHA. Upstream's only listed change is a Bun bump to 1.4.4 (#1916), and none of the action's inputs or permissions changed. This review job ran on 925afb53.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:197) and permission-members (secret-broker-request/action.yml:37). If either input was renamed, GitHub only logs a warning and mints the token with the app's full installation permissions instead of the narrower scope. I still can't check this from the job. Please confirm both inputs exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153), it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems: docker/login-action v4.7.0, action-actionlint v1.80.6, setup-uv v10.3.2 (only in test workflows), setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from ef71307 to ca4b4d0 Compare October 26, 2026 08:26
@github-actions

github-actions Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 26s —— View job

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:197) and permission-members (secret-broker-request/action.yml:37). If either input was renamed, GitHub only logs a warning, and the token is minted with the app's full installation permissions instead of the narrower scope. I still can't check this from the job. Please confirm both inputs exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153), it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems: claude-code-action on 925afb53… (v1.0.262) in all four places, docker/login-action v4.7.0, action-actionlint v1.80.6, setup-uv v10.3.2 (only in test workflows), setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from ca4b4d0 to 9c31f10 Compare October 26, 2026 15:40
@github-actions

github-actions Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 19s —— View job

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:197) and permission-members (secret-broker-request/action.yml:37). If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I still can't check this from the job. Please confirm both inputs exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems: claude-code-action on 925afb53… (v1.0.262) in all four places, docker/login-action v4.7.0, action-actionlint v1.80.6, setup-uv v10.3.2 (only in test workflows), setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 9c31f10 to f3173b9 Compare October 26, 2026 23:53
@github-actions

github-actions Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 27s —— View job

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:197) and permission-members (secret-broker-request/action.yml:37). If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I still can't check this from the job. Please confirm both inputs exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems: docker/login-action v4.7.0, action-actionlint v1.80.6, setup-uv v10.3.2 (only in test workflows), setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from f3173b9 to 633259b Compare October 27, 2026 05:24
@github-actions

github-actions Bot commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 30s —— View job

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

  • New in this push: .github/workflows/actionlint.yaml moves reviewdog/action-actionlint from v1.80.6 to v1.80.8 (cfa6a621…). According to upstream's notes, the only changes are Python docker tag and digest bumps and release-process tweaks. The workflow passes the same inputs as before, and the pin is still a full SHA.
  • Every SHA-pinned ci-test-notify use (cve-scan:166, :196, govulncheck:88) is on d15a1df, so no downgrade has come back. All four claude-code-action pins are on 8041f1d1… (v1.0.263).

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses:

    • permission-checks (comment-triggered-check/action.yml:197)
    • permission-members (secret-broker-request/action.yml:37)

    If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I still can't fetch upstream's action.yml from this job, so this hasn't been checked. Please confirm both inputs exist at 64ab729 before merging.

  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems: docker/login-action v4.7.0, setup-uv v10.3.2 (only in test workflows), setup-kubectl v5.2.0.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 633259b to 2b50189 Compare October 27, 2026 18:13
@github-actions

github-actions Bot commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 39s —— View job

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

New in this push:

  • Checkov image 3.3.0 → 3.3.30 (.github/actions/checkov/action.yml:169). The PR body's table doesn't list this bump. Only the image tag changes; the args, env and inputs stay the same. One thing to know before moving the checkov tag: Checkov adds new policies in patch releases. A caller that doesn't set soft_fail could start failing on IaC that passed under 3.3.0, without changing anything on their side. That isn't a bug in this PR, but it affects how you release it. If callers gate on Checkov, consider leaving the existing tag alone, or tell them before you advance it.
  • setup-uv v10.3.2 now also covers test-backport-fix-imports.yaml:25. That is a test-only workflow and the step passes no inputs, so this is fine.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:197) and permission-members (secret-broker-request/action.yml:37). If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I still can't check this from the job. Please confirm both inputs exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems:

  • claude-code-action is on 8041f1d1… (v1.0.263) in all four places.
  • docker/login-action is on v4.7.0.
  • action-actionlint is on v1.80.8.
  • setup-kubectl is on v5.2.0.
  • govulncheck's ci-test-notify pin moves forward to d15a1df.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 2b50189 to 8749a43 Compare October 27, 2026 19:20
@github-actions

github-actions Bot commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 30s —— View job

Review: PR #291

This push adds no new bugs or security issues. Two items from earlier reviews are still open.

  • New in this push: Renovate rebased onto feat(scheduled-cve-scan): add a reusable daily cve scan workflow #336 (scheduled-cve-scan). That brings in github/codeql-action/upload-sarif v4.38.1 → v4.39.1 (9b325408…) at .github/workflows/scheduled-cve-scan.yaml:80. The step passes only sarif_file, has continue-on-error: true, and is pinned to a full SHA, so a minor bump can't make the scan fail. The PR body's table doesn't list this bump. The diff is now 19 files, +21/−21.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:197) and permission-members (secret-broker-request/action.yml:37). If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I still can't check this from the job. Please confirm both inputs exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.
  • Checkov 3.3.0 → 3.3.30 (checkov/action.yml:169): patch releases add policies. A caller that doesn't set soft_fail could start failing on IaC that passed before, without changing anything on their side. Keep that in mind before you advance the checkov tag.

These haven't changed since the last review and have no problems: claude-code-action on 8041f1d1… (v1.0.263) in all four places, docker/login-action v4.7.0, action-actionlint v1.80.8, setup-uv v10.3.2 (only in test workflows), setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 8749a43 to 7835ff8 Compare October 27, 2026 22:11
@github-actions

github-actions Bot commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 32s —— View job

Review: PR #291

This push adds no new bugs or security issues. Three items from earlier reviews are still open.

  • New in this push: all four anthropics/claude-code-action pins moved to d70510b1… (v1.0.264), and every claude-code-action pin under .github/ is now on that SHA. The changed lines only move the SHA. This review job ran on d70510b1, so the new pin has run end to end once. The PR body's table still says v1.0.263.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:197) and permission-members (secret-broker-request/action.yml:37). If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I still can't check this from the job, because there's no local copy of the action. Please confirm both inputs exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.
  • Checkov 3.3.0 → 3.3.30 (checkov/action.yml:169): patch releases add policies. A caller that doesn't set soft_fail could start failing on IaC that passed before, without changing anything on their side. Keep that in mind before you advance the checkov tag.

These haven't changed since the last review and have no problems: codeql-action/upload-sarif v4.39.1, docker/login-action v4.7.0, action-actionlint v1.80.8, setup-uv v10.3.2 (only in test workflows), setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 7835ff8 to 38df662 Compare October 28, 2026 16:33
@github-actions

github-actions Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 25s —— View job

Review: PR #291

This push adds no new bugs or security issues. Three items from earlier reviews are still open.

  • New in this push: astral-sh/setup-uv moves from v10.3.2 to v10.3.3 (68559e99…) in all six test workflows. The PR body has no notes for v10.3.3, and its table still says v10.3.2. These are test-only workflows, none of the steps pass inputs, and the pin is still a full SHA. None of this group's old digests are left under .github/.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:197) and permission-members (secret-broker-request/action.yml:37). If either input was renamed, GitHub only logs a warning, and the token is minted with the app's full installation permissions instead of the narrower scope. I haven't checked this; I didn't try to fetch upstream's action.yml on this run. Please confirm both inputs exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.
  • Checkov 3.3.0 → 3.3.30 (checkov/action.yml:169): patch releases add policies. A caller that doesn't set soft_fail could start failing on IaC that passed before, without changing anything on their side. Keep that in mind before you advance the checkov tag.

These haven't changed since the last review and have no problems: claude-code-action on d70510b1… (v1.0.264) in all four places, codeql-action/upload-sarif v4.39.1, docker/login-action v4.7.0, action-actionlint v1.80.8, setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 38df662 to 3cf7a32 Compare October 28, 2026 23:13
@github-actions

github-actions Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 18s —— View job

Review: PR #291

This push adds no new bugs or security issues. Three items from earlier reviews are still open, and one of them now carries more risk.

  • New in this push: Checkov moves to 3.4.0, not 3.3.30 (.github/actions/checkov/action.yml:169). The PR body's table still says 3.3.30 and has no notes for the 3.4 line. Only the image tag changes, and the args, env and inputs stay the same. The release risk flagged earlier is larger now. A minor bump can add or tighten policies, not only fix bugs. A caller that doesn't set soft_fail (:48) could start failing on IaC that passed under 3.3.0, with no change on their side. Read the 3.4.0 changelog before you advance the checkov tag. If callers gate on Checkov, leave the existing tag alone, or tell them before you move it.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:197) and permission-members (secret-broker-request/action.yml:37). If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I haven't checked this. Please confirm both inputs exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.

These haven't changed since the last review and have no problems: claude-code-action on d70510b1… (v1.0.264) in all four places, codeql-action/upload-sarif v4.39.1, docker/login-action v4.7.0, action-actionlint v1.80.8, setup-uv v10.3.3 (only in test workflows), setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 3cf7a32 to 6658330 Compare October 29, 2026 14:54
@github-actions

github-actions Bot commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @renovate[bot]'s task in 23s —— View job

Review: PR #291

This push adds no new bugs or security issues. Three items from earlier reviews are still open.

  • New in this push: .github/workflows/actionlint.yaml:38 moves reviewdog/action-actionlint from v1.80.8 to v1.81.0 (5d802a8e…). The PR body's table still says v1.80.8 and has no notes for v1.81.0. Every earlier release in this range only bumped dependencies. The workflow passes the same github_token and reporter inputs as before, and the pin is still a full SHA. This is a lint-only workflow in this repo, so nothing ships to callers from it.

Still open:

  • create-github-app-token v3.3.0 (64ab729a…): upstream's #399, "update permission inputs", may affect two inputs this repo uses: permission-checks (comment-triggered-check/action.yml:197) and permission-members (secret-broker-request/action.yml:37). If either input was renamed, GitHub only logs a warning, and the token gets the app's full installation permissions instead of the narrower scope. I haven't checked this. Please confirm both inputs exist at 64ab729 before merging.
  • openai/codex-action v1.13 (ai-pr-review/action.yml:147): in drop-sudo mode (:153) it now needs setfacl (the acl package) and ACL support on /run. That is a new runner requirement, so the Release Process section of CLAUDE.md calls for a new ai-pr-review major. The exception is if every caller uses the wrapper on GitHub-hosted runners.
  • Checkov 3.3.0 → 3.4.0 (checkov/action.yml:169): a minor bump can add or tighten policies. A caller that doesn't set soft_fail could start failing on IaC that passed under 3.3.0, with no change on their side. Read the 3.4.0 changelog before you advance the checkov tag. If callers gate on Checkov, leave the existing tag alone or tell them first.

These haven't changed since the last review and have no problems: claude-code-action on d70510b1… (v1.0.264) in all four places, codeql-action/upload-sarif v4.39.1, docker/login-action v4.7.0, setup-uv v10.3.3 (only in test workflows), setup-kubectl v5.2.0, and govulncheck's ci-test-notify pin moving forward to d15a1df.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants