Skip to content

Update github actions (main) (patch) - #3478

Open
red-hat-konflux[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main-main/patch-github-actions
Open

Update github actions (main) (patch)#3478
red-hat-konflux[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main-main/patch-github-actions

Conversation

@red-hat-konflux

@red-hat-konflux red-hat-konflux Bot commented Aug 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending
github/codeql-action action patch v4.37.5 → v4.37.6 v4.37.7
step-security/harden-runner action patch v2.20.0 → v2.20.1

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

github/codeql-action (github/codeql-action)

v4.37.6

Compare Source

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #​4070
step-security/harden-runner (step-security/harden-runner)

v2.20.1

Compare Source

What's Changed

  • AWS CodeBuild-hosted runner support
  • Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

@red-hat-konflux
red-hat-konflux Bot enabled auto-merge August 8, 2026 01:49
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 8, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:50 AM UTC · Completed 1:58 AM UTC

Commit: 87c4a29 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Aug 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Review

Findings

High

  • [protected-path] .github/workflows/ — PR modifies 5 files under the protected .github/ path: checks-codecov.yaml, codeql.yaml, lint.yaml, scorecard.yml, website.yaml. The PR has no linked issue authorizing changes to governance/infrastructure files. Human approval is required for protected-path changes.
    Remediation: Obtain human reviewer approval for changes to protected workflow files.

Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR
Previous run

Review

Findings

High

  • [protected-path] .github/workflows/ — All 5 changed files are under .github/, a protected path requiring human approval. This PR has no linked issue providing authorization for modifying governance/infrastructure files. Affected files: checks-codecov.yaml, codeql.yaml, lint.yaml, scorecard.yml, website.yaml.
    Remediation: A repository maintainer must review and approve changes to .github/ workflow files. The changes themselves are mechanical patch-version bumps for step-security/harden-runner (v2.20.0 → v2.20.1) and github/codeql-action (v4.37.5 → v4.37.6) with correct SHA pinning — no permissions, triggers, or configuration changes.

Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR
Previous run (2)

Review

Findings

High

  • [protected-path] .github/workflows/ — All five modified files (checks-codecov.yaml, codeql.yaml, lint.yaml, scorecard.yml, website.yaml) are under the protected .github/ path. This PR has no linked issue providing justification for modifying governance/infrastructure files. While the changes are mechanical patch-level version bumps (step-security/harden-runner v2.20.0 → v2.20.1, github/codeql-action v4.37.5 → v4.37.6) generated by Renovate/MintMaker, human approval is required for all changes to protected paths.
    Remediation: A maintainer should verify the SHA digests correspond to the expected release tags and approve the PR.

Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR
Previous run (3)

Review

Findings

High

  • [protected-path] .github/workflows/ — All 5 changed files (.github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/scorecard.yml, .github/workflows/website.yaml) are under the .github/ protected path. This PR has no linked issue providing explicit authorization for modifying governance/infrastructure files. The changes are routine GitHub Actions digest bumps (step-security/harden-runner v2.20.0 → v2.20.1, github/codeql-action v4.37.5 → v4.37.6) from the red-hat-konflux[bot] automated dependency management bot, and no correctness or security issues were identified in the version updates. Human approval is required for all protected-path changes regardless of content.
    Remediation: A maintainer should review and approve these protected-path changes.

Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR
Previous run (4)

Review

Findings

High

  • [protected-path] .github/workflows/checks-codecov.yaml — All 5 modified files (.github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/scorecard.yml, .github/workflows/website.yaml) are under the .github/ protected path. The PR has no linked issue authorizing changes to governance/infrastructure files. Human approval is required for all protected-path changes.
    Remediation: Obtain explicit human approval for the protected-path modifications.

Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR
Previous run (5)

Review

Findings

High

  • [protected-path] .github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/scorecard.yml, .github/workflows/website.yaml — All 5 changed files are under the .github/ protected path. This PR modifies GitHub Actions workflow files without a linked issue authorizing the changes. The repository's renovate.json includes the helpers:pinGitHubActionDigests preset, confirming this is an expected Renovate-managed update pattern (step-security/harden-runner v2.20.0 → v2.20.1, github/codeql-action v4.37.5 → v4.37.6). Human approval is always required for protected-path changes, regardless of automation source.
    Remediation: A human reviewer should verify the new action digests correspond to the claimed versions and approve.

Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR
Previous run (6)

Review

Findings

High

  • [protected-path] .github/workflows/codeql.yaml, .github/workflows/scorecard.yml — This PR modifies files under the protected .github/ path. No linked issue provides explicit authorization for changes to governance/infrastructure files. While this is an automated Renovate dependency bump (github/codeql-action v4.37.5 → v4.37.6), human approval is required for all protected-path changes. The changes are a straightforward patch version bump with consistent SHA pinning across all four action references.
    Remediation: A maintainer should review and approve these CI workflow changes.

Labels: PR modifies GitHub Actions workflow files under .github/workflows/

Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@fullsend-ai-review fullsend-ai-review Bot added the github_actions Pull requests that update GitHub Actions code label Aug 8, 2026
@codecov

codecov Bot commented Aug 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag Coverage Δ
acceptance 54.38% <ø> (ø)
generative 12.28% <ø> (ø)
integration 23.59% <ø> (ø)
unit 72.20% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/patch-github-actions branch from f899f93 to eed1b05 Compare August 9, 2026 02:01
@red-hat-konflux red-hat-konflux Bot changed the title Update github/codeql-action action to v4.37.6 (main) Update github actions (main) (patch) Aug 9, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 9, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 2:02 AM UTC · Completed 2:10 AM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/patch-github-actions branch from eed1b05 to ceb2e91 Compare August 11, 2026 03:56
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 3:57 AM UTC · Completed 4:06 AM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/patch-github-actions branch from ceb2e91 to 57dd67e Compare August 12, 2026 02:56
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 2:58 AM UTC · Completed 3:07 AM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/patch-github-actions branch from 57dd67e to b2a4161 Compare August 13, 2026 01:02
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:03 AM UTC · Completed 1:12 AM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/patch-github-actions branch from b2a4161 to 5cd2abf Compare August 14, 2026 02:50
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 2:51 AM UTC · Completed 3:01 AM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@red-hat-konflux
Update github actions
06acd5e 
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
@red-hat-konflux
red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/patch-github-actions branch from 5cd2abf to 06acd5e Compare August 15, 2026 01:57
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 15, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:58 AM UTC · Completed 2:07 AM UTC

Commit: 87c4a29 · View workflow run →

fullsend-ai-review[bot]
fullsend-ai-review Bot suggested changes Aug 15, 2026
View reviewed changes

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@fullsend-ai-review fullsend-ai-review[bot] fullsend-ai-review[bot] requested changes
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

github_actions Pull requests that update GitHub Actions code main renovate size: XS

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants