🚨 Update github actions (main) (major)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
actions/cache	action	major	v5.1.0 → v6.1.0
actions/checkout	action	major	v6.1.0 → v7.0.1
actions/configure-pages	action	major	v5.0.0 → v6.0.0
actions/create-github-app-token	action	major	v2.2.2 → v3.2.0
actions/deploy-pages	action	major	v4.0.5 → v5.0.0
actions/download-artifact	action	major	v7.0.0 → v8.0.1
actions/setup-go	action	major	v6.5.0 → v7.0.0
actions/setup-node	action	major	v6.5.0 → v7.0.0
actions/upload-artifact	action	major	v6.0.0 → v7.0.1
actions/upload-pages-artifact	action	major	v4.0.0 → v5.0.0
codecov/codecov-action	action	major	v5.5.5 → v7.0.0
docker/setup-qemu-action	action	major	v3.7.0 → v4.2.0
softprops/action-gh-release	action	major	v2 → v3

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

actions/cache (actions/cache)

v6.1.0

Compare Source

What's Changed

• Bump @​actions/cache to v6.1.0 - handle read-only cache access by @​jasongin in #​1768

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

• Update packages, migrate to ESM by @​Samirat in #​1760

Full Changelog: actions/cache@v5...v6.0.0

v6

Compare Source

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Various dependency updates

v7

Compare Source

• Skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• Trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• Escape values passed to --unset by @​aiqiaoy in #​2530
• Various dependency updates

actions/configure-pages (actions/configure-pages)

v6.0.0

Compare Source

Changelog

• upgrade to node 24 @​salmanmkc (#​186)
• Upgrade IA Publish @​Jcambass (#​165)
• Add workflow file for publishing releases to immutable action package @​Jcambass (#​163)
• pin draft release version @​YiMysty (#​162)
• Bump espree from 9.6.1 to 10.1.0 @​dependabot (#​160)
• Bump eslint-config-prettier from 8.8.0 to 9.1.0 @​dependabot (#​143)
• Be more friendly to Dependabot @​yoannchaudet (#​158)
• Bump eslint-plugin-github from 4.10.2 to 5.0.1 @​dependabot (#​154)
• Bump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group @​dependabot (#​156)
• Bump undici from 5.28.3 to 5.28.4 @​dependabot (#​145)

See details of all code changes since previous release.

v6

Compare Source

actions/create-github-app-token (actions/create-github-app-token)

v3.2.0

Compare Source

Features

• add support for enterprise-level GitHub Apps (#​263) (952a2a7)
• support full repository names in repositories input (#​372) (85eb8dd)

Bug Fixes

• deps: bump @​actions/core from 3.0.0 to 3.0.1 in the production-dependencies group (#​364) (43e5c34)
• validate private-key input (#​376) (f24bbd8)

v3.1.1

Compare Source

Bug Fixes

• improve error message when app identifier is empty (#​362) (07e2b76), closes #​249

v3.1.0

Compare Source

Bug Fixes

• deps: bump p-retry from 7.1.1 to 8.0.0 (#​357) (3bbe07d)

Features

• add client-id input and deprecate app-id (#​353) (e6bd4e6)
• update permission inputs (#​358) (076e948)

v3.0.0

Compare Source

• feat!: node 24 support (#​275) (2e564a0)
• fix!: require NODE_USE_ENV_PROXY for proxy support (#​342) (4451bcb)

Bug Fixes

• remove custom proxy handling (#​143) (dce0ab0)

BREAKING CHANGES

• Custom proxy handling has been removed. If you use HTTP_PROXY or HTTPS_PROXY, you must now also set NODE_USE_ENV_PROXY=1 on the action step.
• Requires Actions Runner v2.327.1 or later if you are using a self-hosted runner.

v3

Compare Source

actions/deploy-pages (actions/deploy-pages)

v5.0.0

Compare Source

Changelog

• Update Node.js version to 24.x @​salmanmkc (#​404)
• Add workflow file for publishing releases to immutable action package @​Jcambass (#​374)
• Bump braces from 3.0.2 to 3.0.3 in the npm_and_yarn group across 1 directory @​dependabot (#​360)
• Make the rebuild dist workflow work nicer with Dependabot @​yoannchaudet (#​361)
• Bump the non-breaking-changes group across 1 directory with 3 updates @​dependabot (#​358)
• Delete repeated sentence @​garethsb (#​359)
• Update README.md @​tsusdere (#​348)
• Bump the non-breaking-changes group with 4 updates @​dependabot (#​341)
• Remove error message for file permissions @​TooManyBees (#​340)

---

See details of all code changes since previous release.

⚠️ For use with products other than GitHub.com, such as GitHub Enterprise Server, please consult the compatibility table.

v5

Compare Source

actions/download-artifact (actions/download-artifact)

v8.0.1

Compare Source

What's Changed

• Support for CJK characters in the artifact name by @​danwkennedy in #​471
• Add a regression test for artifact name + content-type mismatches by @​danwkennedy in #​472

Full Changelog: actions/download-artifact@v8...v8.0.1

v8.0.0

Compare Source

v8 - What's new

[!IMPORTANT]
actions/download-artifact@​v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT]
Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @​actions/* packages, we've upgraded the package to ESM.

What's Changed

• Don't attempt to un-zip non-zipped downloads by @​danwkennedy in #​460
• Add a setting to specify what to do on hash mismatch and default it to error by @​danwkennedy in #​461

Full Changelog: actions/download-artifact@v7...v8.0.0

v8

Compare Source

actions/setup-go (actions/setup-go)

v7.0.0

Compare Source

What's Changed

• Migrate to ESM and upgrade dependencies by @​priyagupta108 in #​763
• chore(deps): bump @​actions/cache to 6.2.0 by @​philip-gai in #​771

New Contributors

• @​philip-gai made their first contribution in #​771

Full Changelog: actions/setup-go@v6...v7.0.0

v7

Compare Source

actions/setup-node (actions/setup-node)

v7.0.0

Compare Source

What's Changed

Enhancements:

• Add cache-primary-key and cache-matched-key as outputs by @​gowridurgad in #​1577
• Migrate to ESM and upgrade dependencies by @​gowridurgad in #​1574

Bug fixes:

• Remove dummy NODE_AUTH_TOKEN export by @​gowridurgad in #​1558
• Only use mirrorToken in getManifest if it's provided by @​deiga in #​1548

Documentation updates:

• Add documentation for publishing to npm with Trusted Publisher (OIDC) by @​chiranjib-swain in #​1536
• docs: Update restore-only cache documentation by @​priya-kinthali in #​1550
• docs: Update caching recommendations to mitigate cache poisoning risks by @​chiranjib-swain in #​1567

Dependency update:

• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​1569

New Contributors

• @​chiranjib-swain made their first contribution in #​1536
• @​deiga made their first contribution in #​1548
• @​jasongin made their first contribution in #​1569

Full Changelog: actions/setup-node@v6...v7.0.0

v7

Compare Source

actions/upload-artifact (actions/upload-artifact)

v7.0.1

Compare Source

What's Changed

• Update the readme with direct upload details by @​danwkennedy in #​795
• Readme: bump all the example versions to v7 by @​danwkennedy in #​796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in #​797

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Add proxy integration test by @​Link- in #​754
• Upgrade the module to ESM and bump dependencies by @​danwkennedy in #​762
• Support direct file uploads by @​danwkennedy in #​764

New Contributors

• @​Link- made their first contribution in #​754

Full Changelog: actions/upload-artifact@v6...v7.0.0

v7

Compare Source

actions/upload-pages-artifact (actions/upload-pages-artifact)

v5.0.0

Compare Source

Changelog

• Update upload-artifact action to version 7 @​Tom-van-Woudenberg (#​139)
• feat: add include-hidden-files input @​jonchurch (#​137)

See details of all code changes since previous release.

v5

Compare Source

codecov/codecov-action (codecov/codecov-action)

v7.0.0

Compare Source

⚠️ Due to migration issues with keybase, we are unable to update our keys under the codecovsecurity account. We have deleted the account and are using codecovsecops with the original gpg key

What's Changed

• ci: remove Enforce License Compliance workflow by @​thomasrockhu-codecov in #​1950
• chore(release): 7.0.0 by @​thomasrockhu-codecov in #​1957

Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0

v7

Compare Source

v6.0.2

Compare Source

This is a copy of the v7.0.0 release to make updates easier

What's Changed

• ci: remove Enforce License Compliance workflow by @​thomasrockhu-codecov in #​1950
• chore(release): 7.0.0 by @​thomasrockhu-codecov in #​1957

Full Changelog: codecov/codecov-action@v6.0.1...v6.0.2

v6.0.1

Compare Source

What's Changed

• fix: prevent template injection in run: steps (VULN-1652) by @​thomasrockhu-codecov in #​1947
• chore(release): 6.0.1 by @​thomasrockhu-codecov in #​1949

Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1

v6.0.0

Compare Source

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

• Revert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0"" by @​thomasrockhu-codecov in #​1929
• Th/6.0.0 by @​thomasrockhu-codecov in #​1928

Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0

v6

Compare Source

docker/setup-qemu-action (docker/setup-qemu-action)

v4.2.0

Compare Source

• Preserve names in esbuild bundle by @​crazy-max in #​311
• Bump @​actions/core from 3.0.0 to 3.0.1 in #​295
• Bump @​docker/actions-toolkit from 0.91.0 to 0.92.0 in #​315
• Bump @​sigstore/core from 3.1.0 to 3.2.1 in #​312
• Bump js-yaml from 4.1.1 to 4.2.0 in #​310
• Bump tmp from 0.2.6 to 0.2.7 in #​304
• Bump undici from 6.26.0 to 6.27.0 in #​308
• Bump vite from 7.3.2 to 7.3.6 in #​307

Full Changelog: docker/setup-qemu-action@v4.1.0...v4.2.0

v4.1.0

Compare Source

• Add reset input to uninstall current emulators by @​crazy-max in #​21
• Bump @​docker/actions-toolkit from 0.77.0 to 0.91.0 in #​250 #​247
• Bump brace-expansion from 1.1.12 to 1.1.15 in #​265
• Bump fast-xml-builder from 1.0.0 to 1.2.0 in #​286
• Bump fast-xml-parser from 5.4.2 to 5.8.0 in #​255
• Bump flatted from 3.3.3 to 3.4.2 in #​257
• Bump glob from 10.3.15 to 10.5.0 in #​254
• Bump handlebars from 4.7.8 to 4.7.9 in #​262
• Bump lodash from 4.17.23 to 4.18.1 in #​273
• Bump postcss from 8.5.6 to 8.5.10 in #​285
• Bump tar from 6.2.1 to 7.5.15 in #​287
• Bump tmp from 0.2.5 to 0.2.6 in #​291
• Bump undici from 6.23.0 to 6.26.0 in #​251
• Bump vite from 7.3.1 to 7.3.2 in #​271

Full Changelog: docker/setup-qemu-action@v4.0.0...v4.1.0

v4.0.0

Compare Source

• Node 24 as default runtime (requires Actions Runner v2.327.1 or later) by @​crazy-max in #​245
• Switch to ESM and update config/test wiring by @​crazy-max in #​241
• Bump @​actions/core from 1.11.1 to 3.0.0 in #​244
• Bump @​docker/actions-toolkit from 0.67.0 to 0.77.0 in #​243
• Bump @​isaacs/brace-expansion from 5.0.0 to 5.0.1 in #​240
• Bump js-yaml from 3.14.1 to 3.14.2 in #​231
• Bump lodash from 4.17.21 to 4.17.23 in #​238

Full Changelog: docker/setup-qemu-action@v3.7.0...v4.0.0

v4

Compare Source

softprops/action-gh-release (softprops/action-gh-release)

v3.0.2

Compare Source

3.0.2 is a patch release focused on release reliability and compatibility. It
reuses existing draft releases when publishing prereleases, supports replacing
release assets on Gitea, hardens streamed asset uploads, and provides clearer
release-creation diagnostics. It also includes TypeScript, coverage, and tooling
maintenance merged since 3.0.1.

This release fixes #​795, #​438, and #​803. The upload transport hardening covers the
historical failure reported in #​790, although current hosted Node 24 runners did
not reproduce it naturally. The diagnostics work is related to #​786 and does not
claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

• feat: improve release error reporting and test coverage by @​chenrui333 in #​813

Bug fixes 🐛

• fix: publish existing draft releases as prereleases by @​godfengliang in #​801
• fix: upload small checksum assets reliably by @​chenrui333 in #​815
• fix: replace existing release assets on Gitea by @​chenrui333 in #​816
• fix: clarify release creation 404 errors by @​chenrui333 in #​817

Other Changes 🔄

• chore(deps): upgrade TypeScript to 7 by @​chenrui333 in #​812
• chore(deps): remove unused TypeScript tooling by @​chenrui333 in #​814
• dependency, Node 24 pin, and CI maintenance merged since 3.0.1

v3.0.1

Compare Source

3.0.1

• maintenance release with updated dependencies

v3.0.0

Compare Source

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24.
Use v3 on GitHub-hosted runners and self-hosted fleets that already support the
Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on
v2.6.2.

What's Changed

Other Changes 🔄

• Move the action runtime and bundle target to Node 24
• Update @types/node to the Node 24 line and allow future Dependabot updates
• Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

v3

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.40% <ø> (-0.01%)	⬇️
generative	16.36% <ø> (ø)
integration	27.58% <ø> (ø)
unit	71.97% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:11 AM UTC · Completed 3:18 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [protected-path] .github/workflows/ — All 6 changed files (checks-codecov.yaml, codeql.yaml, lint.yaml, release.yaml, scorecard.yml, update-go-containerregistry.yaml) are under the .github/ protected path. This PR has no linked issue authorizing changes to governance/infrastructure files. Human approval is required for protected-path changes regardless of context.
  Remediation: Link an authorizing issue or obtain explicit human approval for changes to .github/ workflow files.

Medium

• [api-contract] .github/workflows/update-go-containerregistry.yaml:51 — actions/create-github-app-token v3.2.0 deprecates the app-id input in favor of client-id. The workflow still uses app-id, which will produce a deprecation warning on every run. The workflow continues to function because v3 falls back to app-id, but migration requires both renaming the input and updating the variable value from the numeric App ID to the Client ID (Iv23... format).
  Remediation: Rename app-id to client-id and update the EC_AUTOMATION_APP_ID repository variable from the App ID to the App's Client ID.

Low

• [edge-case] .github/workflows/checks-codecov.yaml:188 — codecov/codecov-action is bumped from v5.5.5 to v7.0.0 (skipping v6). The input schema is unchanged across versions; breaking changes are infrastructure-level (Node 20 to Node 24 runtime) handled automatically on GitHub-hosted runners. No workflow changes needed.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [protected-path] .github/workflows/ (6 files) — All changed files (.github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/release.yaml, .github/workflows/scorecard.yml, .github/workflows/update-go-containerregistry.yaml) are under the .github/ protected path. This PR has no linked issue providing authorization for modifying CI/CD infrastructure files. While renovate.json is configured in the repository and the renovate label confirms this is an authorized bot update, human approval is always required for protected-path changes regardless of context.
  Remediation: A repository maintainer must review and approve these CI/CD workflow changes before merging.

Low

• [api-contract] .github/workflows/checks-codecov.yaml:200 — codecov/codecov-action is bumped from v5.5.4 to v7.0.0 (a two-major-version jump by version number; v6 and v7 share the same commit SHA, so the actual delta is smaller than it appears). The disable_search input parameter used at lines 200, 209, 218, 227 has been confirmed to still exist. Worth a smoke test post-merge to confirm coverage uploads succeed.

• [api-contract] .github/workflows/checks-codecov.yaml:89 — upload-artifact is bumped from v6 to v7 while download-artifact is bumped from v7 to v8. These actions share artifacts within the same workflow run (Test/Acceptance jobs upload, Upload job downloads). The v7/v8 pair are the current matching versions and are designed to work together. Worth monitoring in CI after merge.

Previous run (2)

Review — approve

PR: #3284 — 🚨 Update github actions (main) (major)
Author: red-hat-konflux[bot]
Scope: 6 GitHub Actions workflow files, 13 major version bumps

Summary

This is an automated dependency update from Renovate/Mintmaker that bumps 13 GitHub Actions to their next major versions across 6 workflow files. All action references correctly use pinned commit SHAs with version comments — good supply-chain hygiene.

I verified each updated action's release notes for breaking changes. The changes are safe for this repository's usage patterns:

Action	Update	Breaking change risk
actions/checkout	v6→v7	Node 24 runtime — compatible with ubuntu-latest
actions/cache	v5→v6	ESM migration, read-only cache handling — transparent
actions/setup-go	v6→v7	Node 24 runtime — no input changes
actions/setup-node	v6→v7	Node 24 runtime — no input changes
actions/upload-artifact	v6→v7	Adds direct upload support; existing zipped uploads unaffected
actions/download-artifact	v7→v8	Hash mismatches now error (was warning) — security improvement
actions/configure-pages	v5→v6	Node 24 runtime — no input changes
actions/upload-pages-artifact	v4→v5	Node 24 runtime — no input changes
actions/deploy-pages	v4→v5	Node 24 runtime — no input changes
actions/create-github-app-token	v2→v3	⚠ app-id deprecated in favor of client-id (see below)
codecov/codecov-action	v5→v7	v6.0.2 ≡ v7.0.0; node24 migration only
docker/setup-qemu-action	v3→v4	Node 24 runtime — no input changes
softprops/action-gh-release	v2→v3	Node 24 runtime — same inputs/outputs

Findings

actions/create-github-app-token v3 deprecates app-id input — low

In update-go-containerregistry.yaml, the workflow uses app-id and private-key inputs. The v3.1.0 release of create-github-app-token deprecates app-id in favor of client-id. The old input still works in v3.x but will likely be removed in v4. Consider renaming app-id to client-id (using the app's Client ID from the GitHub App settings page) in a follow-up.

actions/download-artifact v8 — stricter hash enforcement — low

v8 defaults digest-mismatch to error (was warn). This is a security improvement. Standard artifact workflows are unaffected, but if hash mismatches occur due to infrastructure issues, the workflow will now fail rather than warn. This is the correct behavior.

upload-artifact v7 / download-artifact v8 cross-job compatibility — low

The checks-codecov.yaml workflow uploads artifacts in one job and downloads in another. upload-artifact v7 still defaults to zipped uploads (the new archive: false parameter is not used), and download-artifact v8 correctly handles both zipped and direct downloads by checking the Content-Type header. These versions are compatible.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• .github/workflows/checks-codecov.yaml
• .github/workflows/codeql.yaml
• .github/workflows/lint.yaml
• .github/workflows/release.yaml
• .github/workflows/scorecard.yml
• .github/workflows/update-go-containerregistry.yaml

Previous run (3)

Review

Findings

Low

• [api-contract] .github/workflows/checks-codecov.yaml:195 — codecov/codecov-action is bumped from v5.5.4 to v7.0.0 (skipping v6). The workflow uses files:, disable_search:, and flags: inputs across four upload steps (lines 195–228). If v7 dropped or renamed these inputs, the codecov upload steps will fail at runtime.
  Remediation: Verify that codecov-action v7 still supports the files, disable_search, and flags inputs used in this workflow.

• [api-contract] .github/workflows/release.yaml:205 — softprops/action-gh-release v2 to v3 is a major bump. The release workflow uses this action at lines 205 and 215 without explicitly setting the draft input. If v3 changed the default value of draft, releases may be created as drafts unexpectedly.
  Remediation: Verify that the release workflow's behavior is unchanged under softprops/action-gh-release v3, particularly the draft default.

---

Labels: Renovate bot PR updating GitHub Actions dependencies to major versions.

Previous run (4)

Review

Findings

High

• [protected-path] .github/workflows/ — All 6 modified files (.github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/release.yaml, .github/workflows/scorecard.yml, .github/workflows/update-go-containerregistry.yaml) are under the protected .github/ path. This PR has no linked issue providing justification for modifying governance/infrastructure files. Human approval is required for all protected-path changes. The changes themselves are mechanical GitHub Actions major version bumps by the renovate bot and appear correct in form (SHA-pinned with version comments), but protected-path policy requires explicit human sign-off.
  Remediation: A repository maintainer should verify the major version bumps are compatible with the current workflow configurations and approve the protected-path changes.

---

Labels: PR modifies GitHub Actions workflow files

Previous run (5)

Review

Findings

High

• [protected-path] .github/workflows/ — All 6 modified files are under the .github/ protected path. This PR has no linked issue providing authorization for modifying governance/infrastructure files. Human approval is required for all protected-path changes, regardless of the mechanical nature of the update. Files affected: checks-codecov.yaml, codeql.yaml, lint.yaml, release.yaml, scorecard.yml, update-go-containerregistry.yaml.

Info

• [SHA pinning integrity] .github/workflows/ — All 10 action updates are SHA-pinned with version comments. Recommend verifying at least the actions/checkout v7.0.0 SHA (9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0) against upstream before merging.
• [missing-authorization] — No linked issue for this automated dependency update. Authorization is inferred from the mechanical nature of the change (renovate bot PR).
• [artifact-integrity] .github/workflows/checks-codecov.yaml — actions/download-artifact v8 enables hash mismatch enforcement by default, a positive security improvement.
• [permissions-unchanged] .github/workflows/ — No workflow permissions blocks, secrets references, or trigger configurations are modified. No security regression.
• [trigger-safety] .github/workflows/ — No workflows use pull_request_target, so the actions/checkout v7 behavioral change (blocking fork PR checkout) has no impact.

Previous run (6)

Review

Findings

High

• [protected-path] .github/workflows/checks-codecov.yaml, .github/workflows/release.yaml, .github/workflows/scorecard.yml, .github/workflows/update-go-containerregistry.yaml — All modified files are under the .github/ protected path. This PR has no linked issue providing authorization for changes to governance/infrastructure files. Human approval is required for all protected-path changes.
  Remediation: Link an authorizing issue or obtain explicit human maintainer approval for these workflow changes.

Low

• [secrets-handling] .github/workflows/update-go-containerregistry.yaml:54 — actions/create-github-app-token bumped from v2.2.2 to v3.2.0. This action receives the app private key via secrets.EC_AUTOMATION_KEY and generates a scoped GitHub token. Major version bumps of token-minting actions warrant manual verification that the new commit hash corresponds to the genuine v3.2.0 release tag.
  Remediation: Verify the commit hash bcd2ba49218906704ab6c1aa796996da409d3eb1 matches the official actions/create-github-app-token v3.2.0 release.

Info

• [dependency-update] .github/workflows/checks-codecov.yaml — Major version bumps for actions/upload-artifact (v6→v7), actions/download-artifact (v7→v8), and codecov/codecov-action (v5→v7). All actions remain pinned to full commit SHAs with version comments. No permission or secrets changes. The same upload-artifact bump also applies to scorecard.yml.

• [dependency-update] .github/workflows/release.yaml — Major version bumps for docker/setup-qemu-action (v3→v4), actions/configure-pages (v5→v6), actions/upload-pages-artifact (v4→v5), and actions/deploy-pages (v4→v5). All remain pinned to full commit SHAs. No permission or secrets handling changes.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:21 AM UTC · Completed 3:31 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:17 AM UTC · Completed 2:25 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:12 AM UTC · Completed 2:21 AM UTC
Commit: 47d3320 · View workflow run →

Superseded by updated review

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Started 2:11 AM UTC · Ended 2:12 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:46 AM UTC · Completed 3:52 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ❌ Failure · Started 2:25 AM UTC · Completed 2:39 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:41 AM UTC · Completed 2:55 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[medium] api-contract

actions/create-github-app-token v3.2.0 deprecates the app-id input in favor of client-id. The workflow still uses app-id, which will produce a deprecation warning on every run. The workflow continues to function because v3 falls back to app-id, but migration requires both renaming the input and updating the variable value from the numeric App ID to the Client ID (Iv23... format).

Suggested fix: Rename app-id to client-id and update the EC_AUTOMATION_APP_ID repository variable from the App ID to the App's Client ID.

[fullsend-ai-review]

[low] edge-case

codecov/codecov-action is bumped from v5.5.5 to v7.0.0 (skipping v6). The input schema is unchanged across versions; breaking changes are infrastructure-level (Node 20 to Node 24 runtime) handled automatically on GitHub-hosted runners. No workflow changes needed.