chore(deps): update github-actions by renovate[bot] · Pull Request #11 · NX1X/Egret

renovate · 2026-08-01T06:55:58Z

This PR contains the following updates:

Package	Type	Update	Change	Pending
actions/attest-build-provenance	action	minor	`v4.1.1` → `v4.2.2`
actions/checkout	action	patch	`v7.0.0` → `v7.0.1`
github/codeql-action	action	minor	`v4.36.2` → `v4.37.9`	`v4.38.1` (+1)
go	uses-with	minor	`1.26.5` → `1.27.1`
ossf/scorecard-action	action	patch	`v2.4.0` → `v2.4.4`

Release Notes

actions/attest-build-provenance (actions/attest-build-provenance)

`v4.2.2`

Compare Source

[!NOTE]
As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by @dependabot[bot] in #862

Full Changelog: actions/attest-build-provenance@v4.1.1...v4.2.2

actions/checkout (actions/checkout)

`v7.0.1`

Compare Source

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #2475
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #2477
Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in #2478
Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in #2479
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #2488
Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #2476
eslint 9 by @dependabot[bot] in #2474
Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in #2499
skip running unsafe pr check if input is default by @aiqiaoy in #2518
trim only ascii whitespace for branch by @aiqiaoy in #2521
escape values passed to --unset by @aiqiaoy in #2530

github/codeql-action (github/codeql-action)

`v4.37.9`

Compare Source

Update default CodeQL bundle version to 2.26.4. #4106

`v4.37.8`

Compare Source

No user facing changes.

`v4.37.7`

Compare Source

Update default CodeQL bundle version to 2.26.3. #4085

`v4.37.6`

Compare Source

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

`v4.37.5`

Compare Source

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

`v4.37.4`

Compare Source

`v4.37.3`

Compare Source

No user facing changes.

`v4.37.2`

Compare Source

The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

`v4.37.1`

Compare Source

Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
Update default CodeQL bundle version to 2.26.1. #4019

`v4.37.0`

Compare Source

Update default CodeQL bundle version to 2.26.0. #3995
In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

`v4.36.3`

Compare Source

No user facing changes.

actions/go-versions (go)

`v1.27.1`: 1.27.1

Compare Source

Go 1.27.1

`v1.27.0`: 1.27.0

Compare Source

Go 1.27.0

`v1.26.8`: 1.26.8

Compare Source

Go 1.26.8

`v1.26.7`: 1.26.7

Compare Source

Go 1.26.7

`v1.26.6`: 1.26.6

Compare Source

Go 1.26.6

ossf/scorecard-action (ossf/scorecard-action)

`v2.4.4`

Compare Source

What's Changed

This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.

log POST failures instead of failing entire action by @spencerschrock in #1625

Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4

`v2.4.3`

Compare Source

What's Changed

This update bumps the Scorecard version to the v5.3.0 release. For a complete list of changes, please refer to the Scorecard v5.3.0 release notes.

Documentation

docs: clarify GITHUB_TOKEN permissions needed for private repos by @pankajtaneja5 in #1574
📖 Fix recommended command to test the image in development by @deivid-rodriguez in #1583

Other

add missing top-level token permissions to workflows by @timothyklee in #1566
setup codeowners for requesting reviews by @spencerschrock in #1576
🌱 Improve printing options by @deivid-rodriguez in #1584

New Contributors

@timothyklee made their first contribution in #1566
@pankajtaneja5 made their first contribution in #1574
@deivid-rodriguez made their first contribution in #1584

Full Changelog: ossf/scorecard-action@v2.4.2...v2.4.3

`v2.4.2`

Compare Source

What's Changed

This update bumps the Scorecard version to the v5.2.1 release. For a complete list of changes, please refer to the Scorecard v5.2.0 and v5.2.1 release notes.

Full Changelog: ossf/scorecard-action@v2.4.1...v2.4.2

`v2.4.1`

Compare Source

What's Changed

This update bumps the Scorecard version to the v5.1.1 release. For a complete list of changes, please refer to the v5.1.0 and v5.1.1 release notes.
Publishing results now uses half the API quota as before. The exact savings depends on the repository in question.
- use Scorecard library entrypoint instead of Cobra hooking by @spencerschrock in #1423
Some errors were made into annotations to make them more visible
- Make default branch error more prominent by @jsoref in #1459
There is now an optional file_mode input which controls how repository files are fetched from GitHub. The default is archive, but git produces the most accurate results for repositories with .gitattributes files at the cost of analysis speed.
- add input for specifying --file-mode by @spencerschrock in #1509
The underlying container for the action is now hosted on GitHub Container Registry. There should be no functional changes.
- 🌱 publish docker images to GitHub Container Registry by @spencerschrock in #1453

Docs

Installation docs update by @JeremiahAHoward in #1416

New Contributors

@JeremiahAHoward made their first contribution in #1416
@jsoref made their first contribution in #1459
Full Changelog: ossf/scorecard-action@v2.4.0...v2.4.1

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- "before 6am"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

egret-security-app · 2026-08-01T06:56:11Z

🪶 Egret report

Command: bash (+4 argument(s) omitted)
Mode: audit
Exit code: 0
Duration: 520ms
Connections: 1 · Processes: 2 · File writes: 2 · Violations: 1

⚠️ Flagged

Kind	Reason	Detail	Blocked
connection	raw-ip egress	104.20.23.154:443/tcp by curl[2411] with no prior DNS lookup	-

🌐 Connections

PID	Process	Destination	Port	Proto
2411	curl	104.20.23.154	443	tcp

📝 File writes

PID	Process	Op	Path
2411	bash	open-write
2411	curl	open-write	/dev/null

🧬 Processes

PID	PPID	Process	Filename
2411	2400	egret	/usr/bin/bash
2411	2400	bash	/usr/bin/curl

coderabbitai · 2026-09-12T19:43:17Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: f76398ef-af33-412f-b216-809d239c3ed4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

renovate Bot added the dependencies label Aug 1, 2026

renovate Bot requested a review from NX1X as a code owner August 1, 2026 06:55

renovate Bot added the github-actions label Aug 1, 2026

renovate Bot assigned NX1X Aug 1, 2026

renovate Bot force-pushed the renovate/github-actions branch from 8f8860a to 2ddeb34 Compare August 6, 2026 23:54

renovate Bot force-pushed the renovate/github-actions branch 2 times, most recently from 888ab6d to 158badc Compare August 20, 2026 23:53

renovate Bot force-pushed the renovate/github-actions branch from 158badc to c550440 Compare August 29, 2026 04:43

renovate Bot force-pushed the renovate/github-actions branch 2 times, most recently from 43ac40b to 32f8281 Compare September 12, 2026 19:43

chore(deps): update github-actions

6588a8c

renovate Bot force-pushed the renovate/github-actions branch from 32f8281 to 6588a8c Compare September 20, 2026 00:51

Navigation Menu

chore(deps): update github-actions - #11

chore(deps): update github-actions#11
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions

renovate Bot commented Aug 1, 2026 •

edited

Loading

Uh oh!

egret-security-app Bot commented Aug 1, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 12, 2026 •

edited

Loading

Review skipped

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

v1.27.1: 1.27.1

v1.27.0: 1.27.0

v1.26.8: 1.26.8

v1.26.7: 1.26.7

v1.26.6: 1.26.6

What's Changed

What's Changed

Documentation

Other

New Contributors

What's Changed

What's Changed

Docs

New Contributors

Configuration

Uh oh!

egret-security-app Bot commented Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🪶 Egret report

⚠️ Flagged

🌐 Connections

📝 File writes

🧬 Processes

Uh oh!

coderabbitai Bot commented Sep 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Aug 1, 2026 •

edited

Loading

`v1.27.1`: 1.27.1

`v1.27.0`: 1.27.0

`v1.26.8`: 1.26.8

`v1.26.7`: 1.26.7

`v1.26.6`: 1.26.6

egret-security-app Bot commented Aug 1, 2026 •

edited

Loading

coderabbitai Bot commented Sep 12, 2026 •

edited

Loading