Skip to content

chore(deps)!: Update GitHub Actions (major) - #53

Open
williaby wants to merge 1 commit into
mainfrom
renovate/major-github-actions
Open

chore(deps)!: Update GitHub Actions (major)#53
williaby wants to merge 1 commit into
mainfrom
renovate/major-github-actions

Conversation

@williaby

@williaby williaby commented Jun 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Why

Scheduled patch update, bug fixes and security patches with no API changes.

Changes

This PR contains the following updates:

Package Type Update Change OpenSSF
actions/checkout action major v6.0.3 → v7.0.1 OpenSSF Scorecard
actions/checkout action major v6 → v7 OpenSSF Scorecard
actions/setup-python action major v6.2.0 → v7.0.0 OpenSSF Scorecard
astral-sh/setup-uv action major v8.2.0 → v10.1.0 OpenSSF Scorecard

Impact

  • ✅ Patch update: bug fixes and security patches only
  • ✅ No breaking changes

Acceptance Criteria

  • All CI checks pass

Testing

  • CI gates pass (tests, lint, type checking, security scan)

Notes

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

v7.0.0

Compare Source

  • Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
  • Various dependency updates

v7

Compare Source

v6.1.0

Compare Source

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

actions/setup-python (actions/setup-python)

v7.0.0

Compare Source

What's Changed
Enhancements
Bug Fix
Dependency Upgrade
New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

v7

Compare Source

v6.3.0

Compare Source

What's Changed
Enhancement
Dependency update
Documentation
New Contributors

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

astral-sh/setup-uv (astral-sh/setup-uv)

v10.1.0: 🌈 New output python-runtime-idand respect NO_PROXY

Compare Source

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v10.0.1: 🌈 Tolerate transient manifest timeouts

Compare Source

Changes

Thank you @​arguile- for making this action more resilient.

🐛 Bug fixes
🧰 Maintenance
📚 Documentation

v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL features

Compare Source

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

  • pull_request_target
  • workflow_run
  • release

You can read the full reasoning in #​984

version: latest-known
- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from .tool-versions
- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes
🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v9.0.0: 🌈 Change prune-cache default to false

Compare Source

Changes

This release disables the default cache cache pruning to ease the load on the PyPi infrastructure.
Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in #​967

Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.

🚨 Breaking changes
🐛 Bug fixes
  • fix: fall back to distribution ID when os-release has no version field @​cxzhong (#​961)
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v8.3.2: 🌈 update known checksums for 0.11.28

Compare Source

Changes

Just a maintenance release

🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

v8.3.1: 🌈 update known checksums for 0.11.27

Compare Source

Changes

Just a maintenance release

🧰 Maintenance
📚 Documentation

v8.3.0: 🌈 Support uv.lock as a version-file source

Compare Source

Changes

Thanks to @​somaz94 you can now use the pinned version of uv itself in uv.lock. It gets picked up automatically.
If you have pinned another version of uv in your uv.lock you can use the inputs version or version-source to override this.

🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • "after 10pm every weekday,before 5am every weekday,every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

Copilot AI review requested due to automatic review settings June 20, 2026 20:16
@coderabbitai

coderabbitai Bot commented Jun 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review limit reached

Next included review available in 58 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6444c0ec-6037-4bf2-97f3-fd0cfe60c594

📥 Commits

Reviewing files that changed from the base of the PR and between e3ea1fc and f17b84b.

📒 Files selected for processing (9)
  • .github/workflows/ci.yml
  • .github/workflows/codeql.yml
  • .github/workflows/dependency-review.yml
  • .github/workflows/pr-validation.yml
  • .github/workflows/publish-artifact-registry.yml
  • .github/workflows/release.yml
  • .github/workflows/reuse.yml
  • .github/workflows/security-analysis.yml
  • .github/workflows/slsa-provenance.yml
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch renovate/major-github-actions

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Jun 20, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Copilot AI reviewed Jun 20, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the repository’s GitHub Actions workflows to use actions/checkout v7 (pinned by commit SHA) in order to keep CI/security/release automation current.

Changes:

  • Bumped actions/checkout from v6.x to v7 across all workflows that perform a checkout.
  • Updated the pinned checkout digest consistently across CI, security, release, and provenance workflows.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
.github/workflows/slsa-provenance.yml Update checkout action pin to v7 for provenance build job.
.github/workflows/security-analysis.yml Update checkout action pin to v7 for security scan job.
.github/workflows/reuse.yml Update checkout action pin to v7 for REUSE compliance job.
.github/workflows/release.yml Update checkout action pin to v7 for test + release jobs.
.github/workflows/publish-artifact-registry.yml Update checkout action pin to v7 for publish workflow.
.github/workflows/pr-validation.yml Update checkout action pin to v7 for dead-code job.
.github/workflows/dependency-review.yml Update checkout action pin to v7 for dependency review job.
.github/workflows/codeql.yml Update checkout action pin to v7 for CodeQL analysis job.
.github/workflows/ci.yml Update checkout action pin to v7 across CI jobs.

Comment thread .github/workflows/ci.yml Outdated
Comment on lines +50 to +51
- name: Checkout repository
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
@williaby
williaby force-pushed the renovate/major-github-actions branch from 51480f3 to 0d5a5db Compare June 29, 2026 18:13
@williaby
williaby force-pushed the renovate/major-github-actions branch 2 times, most recently from fa229a4 to 7d3002c Compare July 24, 2026 17:21
@williaby williaby changed the title chore(deps)!: Update GitHub Actions to v7 chore(deps)!: Update GitHub Actions (major) Jul 24, 2026
@sonarqubecloud

sonarqubecloud Bot commented Jul 24, 2026

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

@williaby
williaby added this pull request to the merge queue Sep 3, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to no response for status checks Sep 3, 2026
@williaby
williaby added this pull request to the merge queue Sep 3, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to no response for status checks Sep 3, 2026
@williaby
williaby force-pushed the renovate/major-github-actions branch from 7d3002c to f17b84b Compare September 15, 2026 03:18
@sonarqubecloud

sonarqubecloud Bot commented Sep 15, 2026

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

Assignees

No one assigned

Labels

breaking-change dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@williaby