[masenf]

Update SHA-pinned workflow actions to their latest stable upstream releases after reviewing the exact deltas against this repository's configuration. Update the release templates and regenerate their workflows, with a reflex-release news fragment.

Pin updates

Action	Previous	Updated
actions/checkout	v6.0.2	v7.0.1
astral-sh/setup-uv	v8.1.0	v10.2.0
actions/setup-node	v6.4.0	v7.0.0
github/codeql-action	v4.35.4	v4.38.2
CodSpeedHQ/action	v5.2.1	v5.4.0
actions/cache	v5.1.0	v6.1.0
actions/setup-python	v6.2.0	v7.0.0

Safety review

• Checkout's new unsafe-fork guard affects pull_request_target and workflow_run, neither of which is used here. Credential persistence remains disabled.
• Setup-uv restricts token forwarding to GitHub and strengthens checksum verification; all existing embedded checksums are unchanged. Cache pruning now defaults to false, which can increase cache size where the input was implicit. The shared build action already explicitly disables pruning.
• Setup-node's registry and custom-mirror authentication changes are inactive with our inputs. Custom mirrors require another review before enabling them because token fallback behavior changed.
• CodeQL's remote-config and registry-proxy changes are inactive with our local configuration; the repository has no CodeQL tool/config overrides. Token boundaries and hosted-runner tool-cache cleanup were reviewed. Both init and analyze use the same commit; the default CLI becomes 2.27.1.
• CodSpeed's native runner delta was reviewed alongside the action. Its new kernel settings apply to memory mode; our benchmarks use simulation. The downloaded installer matches the action's SHA256, binary checksum verification remains in place, and upstream simulation benchmarks passed.
• Cache's old and new stable branches have identical action source; setup-python's packaging changes retain its Node 24 runtime and our Python inputs.

The final workflow/template diff changes only pins and version comments. Triggers, permissions, inputs, and gate dependencies are unchanged. Adversarial review found no blocking issues.

Validation

• uv run pytest tests/units/test_workflow_gates.py tests/units/reflex_release -q --tb=short: 526 passed.
• uv run ruff check . and uv run ruff format --check .: passed.
• uv run pyright reflex tests: 0 errors, 0 warnings.
• uv run reflex-release sync --check: all five generated workflows up to date.
• All GitHub YAML parses; exact pin-only diff assertions and git diff --check passed.
• Verified each release tag's commit, including peeled annotated tags, and reviewed relevant upstream CI results. Checkout's functional/build/dist checks passed; its separate Dependabot updater reported an error.

Repository Actions execution, CodeQL scanning, and CodSpeed benchmark behavior still need end-to-end confirmation in GitHub CI.

[greptile-apps]

Confidence Score: 5/5

[High risk] Updates pinned versions of CI workflow actions.

The PR appears safe to merge; no actionable regression was established.

Summary

The PR updates SHA-pinned CI actions, keeps the five generated release workflows aligned with their templates, and adds a release news fragment.

• Workflow triggers, permissions, and action inputs are unchanged.
• No actionable regression was established from the reviewed changes.

_{Reviews (1) · Last reviewed commit: "chore(ci): update reviewed SHA-pinned wo..."}

[codspeed]

Merging this PR will degrade performance by 4.41%

❌ 1 regressed benchmark
✅ 149 untouched benchmarks
⏩ 18 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	test_route_argument_extraction	115.7 µs	121 µs	-4.41%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing codex/update-workflow-action-pins (5a56f5d) with main (e080fbf)}

Footnotes

1. 18 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩