ci: bump the github-actions group across 1 directory with 18 updates - #63
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
There was a problem hiding this comment.
Pull request overview
Updates pinned GitHub Actions dependencies across the repository’s active CI, release, and security workflows.
Changes:
- Bumps 18 GitHub Actions dependencies.
- Upgrades several actions across major versions.
- Retains immutable commit-SHA pinning.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/test.yml |
Updates testing, linting, caching, and artifact actions. |
.github/workflows/security.yml |
Updates security scanning and CodeQL actions. |
.github/workflows/scorecard.yml |
Updates Scorecard, upload, and checkout actions. |
.github/workflows/release.yml |
Updates release validation and token-generation actions. |
.github/workflows/labeler.yml |
Updates the pull-request labeler. |
.github/workflows/dependabot-auto-merge.yml |
Updates Dependabot metadata retrieval. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| contents: read | ||
| steps: | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 |
There was a problem hiding this comment.
Flagged for human review — the finding is correct, but the fix does not belong in this PR.
Verified. prompts/seed-cli.md does direct copying these as-is ("GitHub infra (copy as-is unless .tmpl)"), and the templates are behind:
live .github/workflows/test.yml: actions/checkout v7.0.1 actions/setup-go v7.0.0
seed .github/workflows/test.yml: actions/checkout v6.0.2 actions/setup-go v6.3.0
Why not here. Two reasons, both about this PR specifically rather than the merits:
seed/**is outside this PR's diff — this is a Dependabot bump of the repository's own workflows.- This is a Dependabot branch. Per the note in
basecamp/.github'sdependabot-sync-actions-comments.yml, any non-Dependabot push to such a PR flips the actor on the retriggeredpull_requestruns and lifts GitHub's Dependabot sandbox — read-only token, no secrets — over freshly bumped, unreviewed action pins. Not worth doing to land a template sync.
The root cause, which is worth more than the sync. .github/dependabot.yml declares github-actions with directory: "/", and that is the only value the ecosystem accepts: GitHub's options reference says "For GitHub Actions, use the value /. Dependabot will search the /.github/workflows directory, as well as the action.yml/action.yaml file from the root directory." There is no directories: form that reaches seed/.github/workflows/.
So this drift is not an oversight that a one-time sync fixes — nothing will ever update those templates, and they will fall behind again the day after any sync. (Consistent with what is there now: seed/security.yml already carries trivy v0.36.0, so someone has hand-synced parts of it before.)
Two durable options, both needing a maintainer's call:
- Enforce equality in CI — a check that the pins in
seed/.github/workflows/match.github/workflows/, so Dependabot's bump of the live copy fails the build until the template is updated in the same PR.basecamp/.githubalready uses this shape for its embedded updater script ("scripts/ holds the tested source; CI enforces the embedded copy matches"). - Generate the seed from the live workflows at seed time, so there is one copy rather than two.
Leaving this thread open rather than resolving it, since the decision is yours and no code has changed. Happy to send either as its own PR.
There was a problem hiding this comment.
Correcting myself: I was wrong that Dependabot can never reach these templates. It can, and that makes the fix two lines rather than a CI check or a generator.
I took GitHub's "For GitHub Actions, use the value /" as a hard restriction. It isn't — it describes the root case. From dependabot-core's github_actions/file_fetcher.rb:
# In the special case where the root directory is defined we also scan
# the .github/workflows/ folder.
if directory == "/"
workflows_dir = WORKFLOW_DIRECTORY # ".github/workflows"
else
workflows_dir = "." # the directory itself is scanned for *.yml
endA non-root directory is scanned directly for workflow YAML. And it is a supported, tested configuration — from that fetcher's own spec:
context "when an explicit directory is given" do
let(:directory) { "/.github/workflows" }
it "fetches the workflow files relatively to the directory" doSo this maintains the seed templates, with no ongoing friction and nothing to hand-sync:
- package-ecosystem: github-actions
directories:
- "/"
- "/seed/.github/workflows"Note the path has to be the workflows directory itself — "/seed" would scan seed/*.yml and find nothing, which is probably why this looks unsupported at first glance.
Withdrawing both of my earlier suggestions. The CI equality check would have added friction to every action bump forever, and the generator is a rewrite; neither is warranted when the updater can just own the files.
Two things that also temper the severity, for whoever picks this up:
seed/.github/dependabot.yml is itself copied into every generated CLI (prompts/seed-cli.md line 107) and configures github-actions weekly. So a new project self-heals on its first Dependabot run — the stale window is bounded by creation-plus-cooldown, not permanent. The pins currently behind are actions/checkout v6.0.2 and actions/setup-go v6.3.0, neither carrying a known advisory. So this is hygiene, not exposure.
That is an argument for the cheap fix and against the expensive ones, which is where the config change lands. Still leaving the thread open — it is your call and I have not changed any code.
trivy-action published both 0.35.0 and v0.35.0, so the bare comment still resolves. It stopped publishing the bare alias at 0.36.0, where only v0.36.0 exists -- so dependabot, which carries the existing comment style forward, writes '# 0.36.0' and zizmor's ref-version-mismatch (new in 1.29.0) flags it as pointing to an unknown ref. That is what fails the audit on #63. Fixing the style here rather than in the bump means dependabot picks up the v-prefix from now on. 57a97c7e is the same commit under both tags, so the pin is unchanged.
|
@dependabot rebase |
Bumps the github-actions group with 18 updates in the / directory: | Package | From | To | | --- | --- | --- | | [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) | `2.5.0` | `3.1.0` | | [actions/labeler](https://github.com/actions/labeler) | `6.0.1` | `7.0.0` | | [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `7.0.1` | | [actions/setup-go](https://github.com/actions/setup-go) | `6.3.0` | `7.0.0` | | [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `9.2.0` | `9.3.0` | | [actions/create-github-app-token](https://github.com/actions/create-github-app-token) | `2.2.1` | `3.2.0` | | [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.3` | `2.4.4` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.32.6` | `4.37.7` | | [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.35.0` | `0.36.0` | | [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.9.0` | `5.0.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.32.6` | `4.37.7` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.32.6` | `4.37.7` | | [rhysd/actionlint](https://github.com/rhysd/actionlint) | `1.7.11` | `1.7.12` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.6.0` | `0.6.2` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `3.0.2` | `4.0.3` | | [actions/cache/restore](https://github.com/actions/cache) | `5.0.3` | `6.1.0` | | [actions/cache/save](https://github.com/actions/cache) | `5.0.3` | `6.1.0` | Updates `dependabot/fetch-metadata` from 2.5.0 to 3.1.0 - [Release notes](https://github.com/dependabot/fetch-metadata/releases) - [Commits](dependabot/fetch-metadata@21025c7...25dd0e3) Updates `actions/labeler` from 6.0.1 to 7.0.0 - [Release notes](https://github.com/actions/labeler/releases) - [Commits](actions/labeler@634933e...bf12e9b) Updates `actions/checkout` from 6.0.2 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@de0fac2...3d3c42e) Updates `actions/setup-go` from 6.3.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@4b73464...b7ad1da) Updates `golangci/golangci-lint-action` from 9.2.0 to 9.3.0 - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@1e7e51e...ba0d7d2) Updates `actions/create-github-app-token` from 2.2.1 to 3.2.0 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](actions/create-github-app-token@29824e6...bcd2ba4) Updates `ossf/scorecard-action` from 2.4.3 to 2.4.4 - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](ossf/scorecard-action@4eaacf0...2d11466) Updates `actions/upload-artifact` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@bbbca2d...043fb46) Updates `github/codeql-action/upload-sarif` from 4.32.6 to 4.37.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@0d579ff...ff2f1c6) Updates `aquasecurity/trivy-action` from 0.35.0 to 0.36.0 - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](aquasecurity/trivy-action@57a97c7...ed142fd) Updates `actions/dependency-review-action` from 4.9.0 to 5.0.0 - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](actions/dependency-review-action@2031cfc...a1d282b) Updates `github/codeql-action/init` from 4.32.6 to 4.37.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@0d579ff...ff2f1c6) Updates `github/codeql-action/analyze` from 4.32.6 to 4.37.7 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@0d579ff...ff2f1c6) Updates `rhysd/actionlint` from 1.7.11 to 1.7.12 - [Release notes](https://github.com/rhysd/actionlint/releases) - [Changelog](https://github.com/rhysd/actionlint/blob/main/CHANGELOG.md) - [Commits](rhysd/actionlint@393031a...914e7df) Updates `zizmorcore/zizmor-action` from 0.6.0 to 0.6.2 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@6599ee8...3dc1ecc) Updates `dorny/paths-filter` from 3.0.2 to 4.0.3 - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](dorny/paths-filter@de90cc6...ceb8a2b) Updates `actions/cache/restore` from 5.0.3 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@cdf6c1f...55cc834) Updates `actions/cache/save` from 5.0.3 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@cdf6c1f...55cc834) --- updated-dependencies: - dependency-name: actions/cache/restore dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/cache/save dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/create-github-app-token dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/dependency-review-action dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/labeler dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: aquasecurity/trivy-action dependency-version: 0.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: dependabot/fetch-metadata dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: dorny/paths-filter dependency-version: 4.0.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/init dependency-version: 4.37.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: golangci/golangci-lint-action dependency-version: 9.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: rhysd/actionlint dependency-version: 1.7.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.6.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
29728d9 to
053d2d1
Compare
Bumps the github-actions group with 18 updates in the / directory:
2.5.03.1.06.0.17.0.06.0.27.0.16.3.07.0.09.2.09.3.02.2.13.2.02.4.32.4.47.0.07.0.14.32.64.37.70.35.00.36.04.9.05.0.04.32.64.37.74.32.64.37.71.7.111.7.120.6.00.6.23.0.24.0.35.0.36.1.05.0.36.1.0Updates
dependabot/fetch-metadatafrom 2.5.0 to 3.1.0Release notes
Sourced from dependabot/fetch-metadata's releases.
... (truncated)
Commits
25dd0e3v3.1.0 (#692)e073f50Merge pull request #705 from dependabot/dependabot/npm_and_yarn/hono-4.12.140670e16build(deps-dev): bump hono from 4.12.12 to 4.12.147a7fe10Merge pull request #702 from dependabot/dependabot/npm_and_yarn/dependencies-...5168191Updating dist build23882e1build(deps): bump@actions/githubin the dependencies group1072469Merge pull request #701 from dependabot/dependabot/github_actions/actions/cre...43f8a00build(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1b4d904aMerge pull request #703 from dependabot/dependabot/npm_and_yarn/globals-17.5.0c8046bbbuild(deps-dev): bump globals from 17.4.0 to 17.5.0Updates
actions/labelerfrom 6.0.1 to 7.0.0Release notes
Sourced from actions/labeler's releases.
Commits
bf12e9bfeat: migrate to ESM and update dependencies (#949)b8dd2d9Bump@typescript-eslint/eslint-pluginfrom 8.59.1 to 8.61.1 (#942)53affe8Bump js-yaml to 4.2.0, apply npm audit fix, and add undici override for 0 vul...f612d9aFix: Improve PR number validation and warning messages in input handling (#939)f27b608chore: upgrade dependencies (@actions/core,@actions/github, js-yaml, minimat...c5dadc2Add 'changed-files-labels-limit' and 'max-files-changed' configs to allow cap...e52e4fbBump minimatch from 10.0.1 to 10.2.3 (#926)77a4082Fix: Preserve manually added labels during workflow run and refine label sync...25abb3cImprove Labeler Action Documentation and Error Handling for Permissions (#897)395c8cfBump brace-expansion from 1.1.11 to 1.1.12 and document breaking changes in v...Updates
actions/checkoutfrom 6.0.2 to 7.0.1Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Updates
actions/setup-gofrom 6.3.0 to 7.0.0Release notes
Sourced from actions/setup-go's releases.
Commits
b7ad1dachore(deps): bump@actions/cacheto 6.2.0 (#771)0778a10Migrate to ESM and upgrade dependencies (#763)924ae3achore: bump version to 6.5.0 in package.json and package-lock.json (#762)e91cc3bBump@actions/cacheto 5.1.0, log cache write denied (#758)4a2405echore: update@types/nodeand@typescript-eslintdependencies to latest versi...78961f6chore: update@actionsdependencies and refresh license cache (#744)4a36011docs: fix Microsoft build of Go link (#734)8f19afcfeat: add go-download-base-url input for custom Go distributions (#721)27fdb26Bump minimatch from 3.1.2 to 3.1.5 (#727)def8c39Rearrange README.md, add advanced-usage.md (#724)Updates
golangci/golangci-lint-actionfrom 9.2.0 to 9.3.0Release notes
Sourced from golangci/golangci-lint-action's releases.
... (truncated)
Commits
ba0d7d2chore: prepare release v9.3.0efd0857feat: add no-run-logs-group as experimental option (#1403)ed485debuild(deps): bump undici from 6.24.0 to 6.27.08872e8dbuild(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 (#1400)b163415build(deps): bump tmp from 0.2.6 to 0.2.7 (#1399)e52a9f8build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 in the github-ac...8182aa3build(deps): bump tmp from 0.2.5 to 0.2.6 (#1397)5403a41build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 in the github-ac...82606bfchore: prepare release v9.2.197c8387chore: improve workflows (#1394)Updates
actions/create-github-app-tokenfrom 2.2.1 to 3.2.0Release notes
Sourced from actions/create-github-app-token's releases.
... (truncated)
Changelog
Sourced from actions/create-github-app-token's changelog.
Commits
bcd2ba4chore(main): release 3.2.0 (#370)f24bbd8fix: validate private-key input (#376)363531bdocs: capitalize Git as a proper noun in README (#374)fd28011docs: update procedure to configure Git (#287)85eb8ddfeat: support full repository names inrepositoriesinput (#372)c9aabb8build(deps-dev): bump yaml from 2.8.3 to 2.8.4 in the development-dependencie...e02e816build(deps-dev): bump undici from 7.24.6 to 8.2.0 (#366)8d835bfbuild(deps-dev): bump esbuild from 0.27.4 to 0.28.0 in the development-depend...952a2a7feat: add support for enterprise-level GitHub Apps (#263)43e5c34fix(deps): bump@actions/corefrom 3.0.0 to 3.0.1 in the production-dependenc...Updates
ossf/scorecard-actionfrom 2.4.3 to 2.4.4Release notes
Sourced from ossf/scorecard-action's releases.
Commits
2d11466Bump action tag for v2.4.4 release (#1688)1bd3285🌱 Bump the docker-images group across 1 directory with 2 updates (#1...913edce🌱 Bump github.com/containerd...Description has been truncated