Skip to content

Update github actions (main) (patch) - #3478

Open
red-hat-konflux[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main-main/patch-github-actions
Open

Update github actions (main) (patch)#3478
red-hat-konflux[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main-main/patch-github-actions

Conversation

@red-hat-konflux

@red-hat-konflux red-hat-konflux Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
github/codeql-action action patch v4.37.5v4.37.6
step-security/harden-runner action patch v2.20.0v2.20.1

Warning

Some dependencies could not be looked up. Check the warning logs for more information.


Release Notes

github/codeql-action (github/codeql-action)

v4.37.6

Compare Source

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #​4070
step-security/harden-runner (step-security/harden-runner)

v2.20.1

Compare Source

What's Changed

  • AWS CodeBuild-hosted runner support
  • Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.


Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@fullsend-ai-review

fullsend-ai-review Bot commented Aug 8, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:50 AM UTC · Completed 1:58 AM UTC

Commit: 87c4a29 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Aug 8, 2026

Copy link
Copy Markdown

Review

Findings

High

  • [protected-path] .github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/scorecard.yml, .github/workflows/website.yaml — All 5 changed files are under the .github/ protected path. This PR modifies GitHub Actions workflow files without a linked issue authorizing the changes. The repository's renovate.json includes the helpers:pinGitHubActionDigests preset, confirming this is an expected Renovate-managed update pattern (step-security/harden-runner v2.20.0 → v2.20.1, github/codeql-action v4.37.5 → v4.37.6). Human approval is always required for protected-path changes, regardless of automation source.
    Remediation: A human reviewer should verify the new action digests correspond to the claimed versions and approve.

Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR
Previous run

Review

Findings

High

  • [protected-path] .github/workflows/codeql.yaml, .github/workflows/scorecard.yml — This PR modifies files under the protected .github/ path. No linked issue provides explicit authorization for changes to governance/infrastructure files. While this is an automated Renovate dependency bump (github/codeql-action v4.37.5 → v4.37.6), human approval is required for all protected-path changes. The changes are a straightforward patch version bump with consistent SHA pinning across all four action references.
    Remediation: A maintainer should review and approve these CI workflow changes.

Labels: PR modifies GitHub Actions workflow files under .github/workflows/


Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR

fullsend-ai-review[bot]

This comment was marked as outdated.

@fullsend-ai-review fullsend-ai-review Bot added the github_actions Pull requests that update GitHub Actions code label Aug 8, 2026
@codecov

codecov Bot commented Aug 8, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag Coverage Δ
acceptance 54.41% <ø> (ø)
generative 16.36% <ø> (ø)
integration 27.58% <ø> (ø)
unit 71.97% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/patch-github-actions branch from f899f93 to eed1b05 Compare August 9, 2026 02:01
@red-hat-konflux red-hat-konflux Bot changed the title Update github/codeql-action action to v4.37.6 (main) Update github actions (main) (patch) Aug 9, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 9, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 2:02 AM UTC · Completed 2:10 AM UTC

Commit: 87c4a29 · View workflow run →

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

github_actions Pull requests that update GitHub Actions code main renovate size: XS

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants