Skip to content

chore(deps): update github-actions - #651

Merged
rhuanbarreto merged 1 commit into
mainfrom
renovate/github-actions
Oct 24, 2026
Merged

chore(deps): update github-actions#651
rhuanbarreto merged 1 commit into
mainfrom
renovate/github-actions

Conversation

@renovate

@renovate renovate Bot commented Oct 24, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending OpenSSF
actions/create-github-app-token action minor v3.2.0 → v3.3.0 OpenSSF Scorecard
actions/download-artifact action patch v8.0.1 → v8.0.2 OpenSSF Scorecard
actions/upload-artifact action patch v7.0.1 → v7.0.2 OpenSSF Scorecard
astral-sh/setup-uv action minor v10.1.0 → v10.3.0 v10.3.2 (+1) OpenSSF Scorecard
github/codeql-action action minor v4.38.1 → v4.39.0 v4.39.1 OpenSSF Scorecard
ossf/scorecard-action action minor v2.4.4 → v2.5.0 OpenSSF Scorecard
ruby/setup-ruby action minor v1.324.0 → v1.329.0 v1.335.0 (+5) OpenSSF Scorecard
zizmorcore/zizmor-action action minor v0.6.4 → v0.7.1 v0.8.0 OpenSSF Scorecard

Release Notes

actions/create-github-app-token

v3.3.0

Compare Source

Features
Bug Fixes
  • deps: bump nested undici from 6.24.0 to 6.29.0 (#​403) (12461a3)
  • deps: bump the production-dependencies group across 1 directory with 3 updates (#​395) (a69c19d)
actions/download-artifact

v8.0.2

Compare Source

What's Changed
New Contributors

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

actions/upload-artifact

v7.0.2

Compare Source

What's Changed
  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.
New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

astral-sh/setup-uv

v10.3.0: 🌈 Add Python architecture selection

Compare Source

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

v10.2.0: 🌈 Disable automatic cache saves for merge queues

Compare Source

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
github/codeql-action

v4.39.0

Compare Source

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198

v4.38.3

Compare Source

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4188
  • Update default CodeQL bundle version to 2.27.2. #​4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #​4184

v4.38.2

Compare Source

ossf/scorecard-action

v2.5.0

Compare Source

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.

  • The action's container image is built with Go 1.27.2 on a refreshed distroless base. by
    @​justaugustus in #​1716
  • The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still
    recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @​justaugustus in #​1716
  • The Scorecard version in results now always matches the Scorecard release the action is built
    with. by @​justaugustus in #​1718
  • The action no longer prints the GitHub token variable while validating its options. by
    @​arpitjain099 in #​1709
  • results_format accepts intoto, which wraps the JSON results in an in-toto attestation
    statement. by @​puerco in #​1702
Other

New Contributors

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

ruby/setup-ruby

v1.329.0

Compare Source

What's Changed

Full Changelog: ruby/setup-ruby@v1.328.0...v1.329.0

v1.328.0

Compare Source

What's Changed

Full Changelog: ruby/setup-ruby@v1.327.0...v1.328.0

v1.327.0

Compare Source

What's Changed

Full Changelog: ruby/setup-ruby@v1.326.0...v1.327.0

v1.326.0

Compare Source

What's Changed

Full Changelog: ruby/setup-ruby@v1.325.0...v1.326.0

v1.325.0

Compare Source

What's Changed

Full Changelog: ruby/setup-ruby@v1.324.0...v1.325.0

zizmorcore/zizmor-action

v0.7.1

Compare Source

zizmor changes

Bug Fixes 🐛🔗

  • Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Compare Source

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

  • The typosquat-uses audit now supports pre-commit config inputs (#​2437)

  • The self-hosted-runner audit is now significantly more precise (#​2350)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#​2396)

  • zizmor is now aware of the image_version workflow trigger (#​2397)

  • The dangerous-triggers audit now produces more precise finding/diagnostic spans (#​2402)

  • The cache-poisoning audit is now aware of pnpm/setup (#​2409)

  • The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#​2395)

    Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

  • The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#​2418)

  • The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#​2426)

  • zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#​2444)

Bug Fixes 🐛🔗

  • Fixed a class of false positives/imprecisions in adhoc-packages that caused some pnpm and yarn invocations to be misclassified as package installations (#​2386)

    Many thanks to @​marcalexiei for implementing this improvement!

  • Fixed a bug where zizmor would fail to honor Git submodules and worktrees when discovering configuration files relative to a repo root (#​2390)

  • Fixed a bug where the ref-version-mismatch audit would crash on unusually placed version comments (#​2394)

  • Fixed a bug where zizmor would fail to handle some pre-commit inputs that use prek extensions to the language_version and default_language_version keys (#​2413)

  • Fixed a bug where the use-trusted-publishing audit would fail to detect certain true-positive patterns inside of PowerShell blocks (#​2444)

action notes

What's Changed

New Contributors

Full Changelog: zizmorcore/zizmor-action@v0.6.4...v0.7.0

Configuration

📅 Schedule: (in timezone Europe/Oslo)

  • Branch creation
    • Between 12:00 AM and 05:59 AM, between day 25 and 31 of the month, and on Sunday (* 0-5 25-31 * 0)
  • Automerge
    • Between 12:00 AM and 05:59 AM, between day 25 and 31 of the month, and on Sunday (* 0-5 25-31 * 0)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from rhuanbarreto as a code owner October 24, 2026 15:57
@coderabbitai

coderabbitai Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 0b650f5a-c3e9-4a8f-9c43-cc56fd96ec4b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 3c3ed81 to 7a73c55 Compare October 24, 2026 15:59
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying archgate-cli with  Cloudflare Pages  Cloudflare Pages

Latest commit: 7d199ce
Status: ✅  Deploy successful!
Preview URL: https://4054122d.archgate-cli.pages.dev
Branch Preview URL: https://renovate-github-actions.archgate-cli.pages.dev

View logs

@github-actions

github-actions Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Code Coverage

Metric Value
Lines 99.9% (11316 / 11326)
Threshold 99.9% minimum — met
Platforms Linux + Windows

Full HTML report available in workflow artifacts.

Per-directory breakdown
Directory Coverage Lines
src/commands/ 100.0% 2340 / 2340
src/engine/ 100.0% 2622 / 2623
src/formats/ 100.0% 151 / 151
src/helpers/ 99.9% 6203 / 6212

@renovate
renovate Bot force-pushed the renovate/github-actions branch from 7a73c55 to 3d479dc Compare October 24, 2026 17:52
@rhuanbarreto
rhuanbarreto enabled auto-merge (squash) October 24, 2026 17:52
@renovate
renovate Bot force-pushed the renovate/github-actions branch from 3d479dc to 61af85b Compare October 24, 2026 17:54
@renovate
chore(deps): update github-actions
7d199ce 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate
renovate Bot force-pushed the renovate/github-actions branch from 61af85b to 7d199ce Compare October 24, 2026 18:00
@rhuanbarreto
rhuanbarreto merged commit b6413d0 into main Oct 24, 2026
33 checks passed
@rhuanbarreto
rhuanbarreto deleted the renovate/github-actions branch October 24, 2026 18:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rhuanbarreto rhuanbarreto rhuanbarreto approved these changes

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rhuanbarreto