chore(deps)!: Update GitHub Actions (major)#19
Conversation
WalkthroughEight GitHub Actions workflow files receive pinned version updates for their constituent actions (checkout, setup tools, code quality/artifact handlers, and signing tools) while maintaining all existing workflow logic, job configurations, and step inputs. ChangesGitHub Actions Dependency Updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related issues
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
williaby
force-pushed
the
renovate/major-github-actions
branch
2 times, most recently
from
257585c to
0e55c65
Compare
williaby
force-pushed
the
renovate/major-github-actions
branch
from
0e55c65 to
0a64017
Compare
There was a problem hiding this comment.
Pull request overview
This PR updates pinned versions (commit SHAs) of several GitHub Actions used across the repository’s CI/security workflows, aligning them with newer major releases.
Changes:
- Bump core CI actions (checkout, setup-python, upload-artifact) to newer major versions across multiple workflows.
- Upgrade security/scanning actions (SonarSource scan action, CodeQL action, GitHub Script, SLSA provenance attestation, cosign installer, lychee, REUSE).
- Refresh UV setup action in workflows that use
astral-sh/setup-uv.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/sonarcloud.yml | Updates checkout/setup-python/Sonar scan/upload-artifact action pins for SonarCloud analysis. |
| .github/workflows/slsa-provenance.yml | Updates action pins used during build + provenance attestation generation. |
| .github/workflows/reuse.yml | Updates checkout/REUSE/upload-artifact action pins for license compliance checks. |
| .github/workflows/release-sign.yml | Updates checkout + cosign-installer pins for signing release artifacts. |
| .github/workflows/pr-validation.yml | Updates checkout/setup-python/setup-uv/lychee pins for PR validation checks. |
| .github/workflows/fips-compatibility.yml | Updates checkout/setup-uv/upload-artifact/github-script pins for FIPS checks and PR commenting. |
| .github/workflows/dependency-review.yml | Updates checkout pin in dependency review workflow. |
| .github/workflows/codeql.yml | Updates checkout/setup-python/setup-uv/CodeQL pins for CodeQL scanning. |
| .github/workflows/cifuzzy.yml | Updates checkout/CodeQL upload-sarif/upload-artifact pins for fuzzing workflow. |
Comments suppressed due to low confidence (2)
.github/workflows/sonarcloud.yml:114
- SonarSource/sonarqube-scan-action v8 changes the default for signature verification (skipSignatureVerification now defaults to false per the upstream release notes). Since this workflow doesn’t set that input explicitly, the upgrade changes behavior and may cause unexpected failures if signature verification can’t run in the runner environment. Consider setting skipSignatureVerification explicitly (true/false) to make the intended behavior stable across upgrades.
- name: SonarCloud Scan
uses: SonarSource/sonarqube-scan-action@59db25f34e16620e48ab4bb9e4a5dce155cb5432 # v8.0.0
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed for PR decoration
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} # SonarCloud authentication
with:
args: >
.github/workflows/dependency-review.yml:28
- This workflow pins actions/checkout by commit SHA, but actions/dependency-review-action is still referenced by the mutable tag @v4. For supply-chain safety and consistency with the rest of these workflow updates, pin dependency-review-action to a specific commit SHA (and keep the version in a comment) to prevent unintended changes from a tag move.
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Dependency Review
uses: actions/dependency-review-action@v4
with:
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| with: |
| @@ -38,7 +38,7 @@ jobs: | |||
|
|
|||
There was a problem hiding this comment.
Fixed in commit ae82201: fsfe/reuse:latest replaced with fsfe/reuse:6.2.0@sha256:85462a75c0f8efda09ddd190b92816b70e7662577c8427429e11e1b9f25a992e (tag+digest immutable form). The 6.2.0 digest currently matches what :latest resolved to, so this preserves semantics while making the image pull reproducible.
williaby
force-pushed
the
renovate/major-github-actions
branch
from
0a64017 to
e3d3a57
Compare
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
williaby
force-pushed
the
renovate/major-github-actions
branch
from
e3d3a57 to
ba8c7e6
Compare
✅ Performance Regression CheckStatus: PERFORMANCE OK
Threshold: +/-10% allowed regression ✅ Performance is within acceptable range. Additional Metrics
About Performance Regression TestingThis automated check compares
To reproduce locally: uv run python scripts/benchmark.py --iterations 1000 |
williaby
force-pushed
the
renovate/major-github-actions
branch
2 times, most recently
from
14ec59b to
6d47f0b
Compare
✅ Performance Regression CheckStatus: PERFORMANCE OK
Threshold: +/-10% allowed regression ✅ Performance is within acceptable range. Additional Metrics
About Performance Regression TestingThis automated check compares
To reproduce locally: uv run --frozen python scripts/benchmark.py --iterations 1000 |
williaby
force-pushed
the
renovate/major-github-actions
branch
from
6d47f0b to
575d536
Compare
✅ Performance Regression CheckStatus: PERFORMANCE OK
Threshold: +/-10% allowed regression ✅ Performance is within acceptable range. Additional Metrics
About Performance Regression TestingThis automated check compares
To reproduce locally: uv run --frozen python scripts/benchmark.py --iterations 1000 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/cifuzzy.yml:
- Around line 42-43: The checkout step named "Checkout repository" uses
actions/checkout without disabling persisted credentials; update that step (the
one using actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd) to include
persist-credentials: false so the runner does not leave Git credentials
persisted after checkout.
In @.github/workflows/dependency-review.yml:
- Around line 29-30: The checkout step using actions/checkout (uses:
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd) persists the GitHub
token by default; add persist-credentials: false to that checkout step to
disable storing credentials in git config for this read-only PR analysis
workflow so no token is retained after checkout.
In @.github/workflows/fips-compatibility.yml:
- Around line 57-59: The checkout steps currently call
actions/checkout@de0fac2e4500... without disabling credential persistence;
update both Checkout repository steps (the one using
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd and the second
checkout in the fips-runtime-test job) to include persist-credentials: false so
the GitHub token is not written to the workspace and cannot be used by
downstream steps.
In @.github/workflows/performance-regression.yml:
- Around line 55-56: The checkout step uses actions/checkout@de0fac2e... without
disabling credential persistence; add the persist-credentials: false option to
the Checkout step (the actions/checkout usage) so credentials are not stored in
the runner after checkout, ensuring the workflow does not keep GitHub tokens in
the environment when no authenticated git operations occur.
In @.github/workflows/pr-validation.yml:
- Around line 55-57: The checkout action usages (uses:
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd) currently omit
persist-credentials and must explicitly disable credential persistence; locate
each actions/checkout invocation in the workflow (the three occurrences of uses:
actions/checkout@...) and add persist-credentials: false under the step to
ensure repository credentials are not stored for subsequent steps or jobs.
In @.github/workflows/release-sign.yml:
- Around line 24-25: The checkout step uses actions/checkout@de0fac2e... but
currently leaves credentials persisted; update the Checkout step (the
actions/checkout invocation) to set persist-credentials: false so the checkout
action does not inject or persist the workflow token (GH_TOKEN) into the
workspace for the signing job; this change should be applied to the existing
Checkout step in the release-sign workflow where actions/checkout is used.
In @.github/workflows/reuse.yml:
- Around line 28-29: Update both Checkout steps that use actions/checkout (the
step named "Checkout repository" and the other checkout step later) to include
the security flag persist-credentials: false under the step to prevent automatic
credential persistence; locate the steps that reference uses:
actions/checkout@de0fac2e4500d... and the second actions/checkout occurrence and
add persist-credentials: false as a top-level key in each step.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 71aca43e-ac08-45da-88f4-f916d965bbbc
📒 Files selected for processing (9)
.github/workflows/cifuzzy.yml.github/workflows/codeql.yml.github/workflows/dependency-review.yml.github/workflows/fips-compatibility.yml.github/workflows/performance-regression.yml.github/workflows/pr-validation.yml.github/workflows/release-sign.yml.github/workflows/reuse.yml.github/workflows/slsa-provenance.yml
| - name: Checkout repository | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Find and examine the cifuzzy.yml workflow file
find . -name "cifuzzy.yml" -type fRepository: ByronWilliamsCPA/rag-processor
Length of output: 106
🏁 Script executed:
# Once found, examine the checkout section and surrounding context
cat -n .github/workflows/cifuzzy.yml | head -100Repository: ByronWilliamsCPA/rag-processor
Length of output: 3987
Disable persisted Git credentials in checkout.
Line 43: actions/checkout leaves credentials persisted by default. Set persist-credentials: false since this workflow performs no authenticated git operations after checkout, reducing token exposure.
🔒 Suggested fix
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout repository | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 42-43: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/cifuzzy.yml around lines 42 - 43, The checkout step named
"Checkout repository" uses actions/checkout without disabling persisted
credentials; update that step (the one using
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd) to include
persist-credentials: false so the runner does not leave Git credentials
persisted after checkout.
There was a problem hiding this comment.
Deferred to a follow-up PR. The finding is valid hardening guidance, but the omission of persist-credentials: false is pre-existing — it was absent on the prior v4.3.1 checkout pin too, not introduced by this Renovate version-bump PR. Keeping this PR scoped to the action version bumps and SHA pinning of dependency-review-action + fsfe/reuse image. A separate chore(security): harden checkout calls PR will address all checkout invocations missing the flag (codeql.yml already has it; 7 others remain across this list of files). Not blocking this PR's merge.
There was a problem hiding this comment.
@williaby, understood — the omission is clearly pre-existing and out of scope for a version-bump-only PR. The scoping rationale is sound.
Would you like me to open a GitHub issue to track the follow-up hardening work? I can create it with a reference back to this PR and list the seven workflow files that still need persist-credentials: false added to their checkout steps, so nothing gets lost before the dedicated chore(security): harden checkout calls PR lands.
| - name: Checkout repository | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/dependency-review.ymlRepository: ByronWilliamsCPA/rag-processor
Length of output: 1854
🏁 Script executed:
# Check if there are other checkout steps in the repository's workflows to see patterns
rg "actions/checkout" .github/workflows/ -A 2 -B 1Repository: ByronWilliamsCPA/rag-processor
Length of output: 3904
Disable credential persistence in checkout step.
Line 30 should set persist-credentials: false to prevent the GitHub token from being stored in git config. This workflow is a read-only PR analysis job that doesn't require authenticated git operations and shouldn't retain credentials.
🔒 Suggested fix
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout repository | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 29-30: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/dependency-review.yml around lines 29 - 30, The checkout
step using actions/checkout (uses:
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd) persists the GitHub
token by default; add persist-credentials: false to that checkout step to
disable storing credentials in git config for this read-only PR analysis
workflow so no token is retained after checkout.
There was a problem hiding this comment.
Deferred to a follow-up PR. The finding is valid hardening guidance, but the omission of persist-credentials: false is pre-existing — it was absent on the prior v4.3.1 checkout pin too, not introduced by this Renovate version-bump PR. Keeping this PR scoped to the action version bumps and SHA pinning of dependency-review-action + fsfe/reuse image. A separate chore(security): harden checkout calls PR will address all checkout invocations missing the flag (codeql.yml already has it; 7 others remain across this list of files). Not blocking this PR's merge.
There was a problem hiding this comment.
@williaby, that's a reasonable scoping call — keeping the Renovate PR focused purely on version bumps is cleaner. The finding is noted, and it's helpful to know codeql.yml already has the flag set while 7 others still need it.
Would you like me to open a GitHub issue to track the chore(security): harden checkout calls follow-up? I can pre-populate it with the list of workflows that still need persist-credentials: false so nothing slips through.
✏️ Learnings added
Learnt from: williaby
Repo: ByronWilliamsCPA/rag-processor PR: 19
File: .github/workflows/dependency-review.yml:29-30
Timestamp: 2026-05-21T04:02:02.792Z
Learning: In the ByronWilliamsCPA/rag-processor repository, `codeql.yml` already sets `persist-credentials: false` on its `actions/checkout` step, but 7 other workflow files (cifuzzy.yml, dependency-review.yml, fips-compatibility.yml, performance-regression.yml, pr-validation.yml, release-sign.yml, reuse.yml, slsa-provenance.yml) are missing this flag. A follow-up `chore(security): harden checkout calls` PR is planned to address all remaining checkout invocations.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
| - name: Checkout repository | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
fd -t f "fips-compatibility.yml" .github/workflows/Repository: ByronWilliamsCPA/rag-processor
Length of output: 115
🏁 Script executed:
cat -n .github/workflows/fips-compatibility.ymlRepository: ByronWilliamsCPA/rag-processor
Length of output: 9979
🏁 Script executed:
# Verify that actions/checkout supports persist-credentials parameter
web_search "actions/checkout persist-credentials false security best practice"Repository: ByronWilliamsCPA/rag-processor
Length of output: 125
🌐 Web query:
actions/checkout persist-credentials false github actions security
💡 Result:
The persist-credentials input for the actions/checkout GitHub Action controls whether the repository's authentication token (typically the GITHUB_TOKEN) is persisted in the local Git configuration (.git/config) after the checkout step [1][2]. By default, persist-credentials is true [1][2]. When enabled, this allows subsequent steps in the same job to execute authenticated Git commands (e.g., git fetch, git push) without needing to manually re-authenticate [1][2]. Security Implications: - Potential for Exposure: Because the token is stored in the Git configuration, any subsequent step or script running within the same job—including potentially compromised third-party actions—can access the token [3][4]. - Artifact Leaks: If a workflow creates and uploads artifacts of the repository (e.g., using actions/upload-artifact), the credential stored in .git/config may be inadvertently included in the uploaded artifact, potentially exposing the token if the artifact is public or accessible to unauthorized users [5]. Recent Security Improvements: GitHub has updated actions/checkout to improve how these credentials are handled. Instead of storing them directly in .git/config, the action now persists credentials in a separate, temporary file located under $RUNNER_TEMP [1][2][6]. It uses Git's includeIf mechanism to conditionally apply these credentials only when performing Git operations within that specific workspace [6]. Recommendation: To follow the principle of least privilege, you should set persist-credentials: false in any workflow that does not explicitly require authenticated Git operations (such as pushing changes) [4]. This reduces the attack surface by ensuring that even if a workflow step is compromised, the GITHUB_TOKEN is not readily available in the local configuration [4]. Example: - uses: actions/checkout@v4 with: persist-credentials: false
Citations:
- 1: https://github.com/actions/checkout/blob/main/README.md
- 2: https://github.com/actions/checkout
- 3: Remove
persist-credentialsor change the default tofalseactions/checkout#485 - 4: Add persist-credentials: false to GitHub Actions checkout steps aquasecurity/trivy#10305
- 5: https://yossarian.net/til/post/actions-checkout-can-leak-github-credentials/
- 6: Persist creds to a separate file actions/checkout#2286
Disable persisted credentials in both checkout steps.
Lines 58 and 204 should set persist-credentials: false to reduce token exposure in downstream steps. Since neither job performs authenticated Git operations (only checkout, running Python scripts, and uploading artifacts), the credential is unnecessary and should not be persisted per security best practices.
Suggested fix
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: falseApply the same change at line 204 in the fips-runtime-test job.
Also applies to: 203-205
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 57-58: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/fips-compatibility.yml around lines 57 - 59, The checkout
steps currently call actions/checkout@de0fac2e4500... without disabling
credential persistence; update both Checkout repository steps (the one using
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd and the second
checkout in the fips-runtime-test job) to include persist-credentials: false so
the GitHub token is not written to the workspace and cannot be used by
downstream steps.
There was a problem hiding this comment.
Deferred to a follow-up PR. The finding is valid hardening guidance, but the omission of persist-credentials: false is pre-existing — it was absent on the prior v4.3.1 checkout pin too, not introduced by this Renovate version-bump PR. Keeping this PR scoped to the action version bumps and SHA pinning of dependency-review-action + fsfe/reuse image. A separate chore(security): harden checkout calls PR will address all checkout invocations missing the flag (codeql.yml already has it; 7 others remain across this list of files). Not blocking this PR's merge.
There was a problem hiding this comment.
@williaby — that's a fair and well-reasoned scoping decision. The finding is valid security hardening, but since it predates this PR and is being tracked for a dedicated follow-up, it shouldn't block these version bumps.
Would you like me to open a GitHub issue to track the chore(security): harden checkout calls work? I can pre-populate it with the list of affected workflow files (the 7 remaining without persist-credentials: false) and backlink it to this PR.
✏️ Learnings added
Learnt from: williaby
Repo: ByronWilliamsCPA/rag-processor PR: 19
File: .github/workflows/fips-compatibility.yml:57-59
Timestamp: 2026-05-21T04:02:05.271Z
Learning: In the ByronWilliamsCPA/rag-processor repository, `persist-credentials: false` is intentionally absent from most `actions/checkout` steps across `.github/workflows/` — it is pre-existing technical debt, not introduced by individual PRs. Only `codeql.yml` currently sets this flag. A dedicated follow-up PR (`chore(security): harden checkout calls`) is planned to add it to the remaining 7 workflow files: cifuzzy.yml, dependency-review.yml, fips-compatibility.yml, performance-regression.yml, pr-validation.yml, release-sign.yml, reuse.yml, and slsa-provenance.yml.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
| - name: Checkout repository | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/performance-regression.yml | head -70Repository: ByronWilliamsCPA/rag-processor
Length of output: 2880
🏁 Script executed:
rg "persist-credentials" .github/workflows/Repository: ByronWilliamsCPA/rag-processor
Length of output: 140
🌐 Web query:
GitHub Actions checkout action persist-credentials security best practice
💡 Result:
Best practice: set persist-credentials: false on every actions/checkout step unless you specifically need authenticated git credentials (e.g., for pushing back) in later steps. GitHub’s actions/checkout docs describe that the token/credential is persisted in the local git config by default and removed during post-job cleanup, and recommend using persist-credentials: false to opt out [1][2]. Example (hardened checkout): uses: actions/checkout@v4 with: persist-credentials: false Why: - Persisting credentials means the auth token/credential can be present in the checked-out workspace’s git configuration and therefore is more exposed to any process running after checkout in the same job. The actions/checkout project explicitly documents that behavior and the opt-out flag [1][2]. - Security guidance and community recommendations commonly call out using persist-credentials: false to reduce credential exposure risk if the workflow or environment is compromised [3]. Notes / tradeoffs: - If you truly need to run authenticated git commands later (push, create tags/releases, etc.), you may need credentials. In that case, prefer minimizing scope and permissions (e.g., least-privilege GITHUB_TOKEN permissions), and consider reconfiguring credentials only for the step that needs them (some workflows re-set the remote URL after using persist-credentials: false) [4]. Summary recommendation: - Default to persist-credentials: false for checkout steps; only opt in when a later step must perform authenticated git operations, and then constrain permissions as tightly as possible. [1][2][3]
Citations:
- 1: https://github.com/actions/checkout
- 2: https://github.com/actions/checkout/blob/main/README.md
- 3: https://cheatsheetseries.owasp.org/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.html
- 4: Reconfigure credentials when `persist-credentials: false` is set stefanzweifel/git-auto-commit-action#356
Harden checkout by disabling credential persistence.
Line 56 should explicitly set persist-credentials: false. The workflow performs no authenticated git operations after checkout, and GitHub's documentation recommends this setting to minimize credential exposure.
🔒 Suggested fix
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout repository | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 55-56: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/performance-regression.yml around lines 55 - 56, The
checkout step uses actions/checkout@de0fac2e... without disabling credential
persistence; add the persist-credentials: false option to the Checkout step (the
actions/checkout usage) so credentials are not stored in the runner after
checkout, ensuring the workflow does not keep GitHub tokens in the environment
when no authenticated git operations occur.
There was a problem hiding this comment.
Deferred to a follow-up PR. The finding is valid hardening guidance, but the omission of persist-credentials: false is pre-existing — it was absent on the prior v4.3.1 checkout pin too, not introduced by this Renovate version-bump PR. Keeping this PR scoped to the action version bumps and SHA pinning of dependency-review-action + fsfe/reuse image. A separate chore(security): harden checkout calls PR will address all checkout invocations missing the flag (codeql.yml already has it; 7 others remain across this list of files). Not blocking this PR's merge.
There was a problem hiding this comment.
@williaby, understood — the finding is valid but genuinely pre-existing, and keeping Renovate bump PRs narrowly scoped is the right call. The planned chore(security): harden checkout calls PR sounds like the correct place to address all 7 remaining checkout invocations at once.
Would you like me to open a GitHub issue to track that follow-up hardening work? I can link back to this PR and comment for context.
✏️ Learnings added
Learnt from: williaby
Repo: ByronWilliamsCPA/rag-processor PR: 19
File: .github/workflows/performance-regression.yml:55-56
Timestamp: 2026-05-21T04:02:05.948Z
Learning: In the ByronWilliamsCPA/rag-processor repository, `persist-credentials: false` is already set on the `actions/checkout` step in `.github/workflows/codeql.yml`, but is missing from 7 other workflow files: `cifuzzy.yml`, `dependency-review.yml`, `fips-compatibility.yml`, `performance-regression.yml`, `pr-validation.yml`, `release-sign.yml`, and `reuse.yml`. A follow-up PR titled `chore(security): harden checkout calls` is planned to address all remaining checkout steps missing this flag.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
| - name: Checkout repository | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/pr-validation.yml | sed -n '50,135p'Repository: ByronWilliamsCPA/rag-processor
Length of output: 3629
Disable checkout credential persistence across all jobs.
Lines 56, 97, and 129 should all set persist-credentials: false to minimize credential exposure in workflows where repository credentials are unnecessary.
🔒 Suggested fix
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
...
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
...
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: falseAlso applies to: 97–98, 129–130
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 55-56: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-validation.yml around lines 55 - 57, The checkout
action usages (uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd)
currently omit persist-credentials and must explicitly disable credential
persistence; locate each actions/checkout invocation in the workflow (the three
occurrences of uses: actions/checkout@...) and add persist-credentials: false
under the step to ensure repository credentials are not stored for subsequent
steps or jobs.
There was a problem hiding this comment.
Deferred to a follow-up PR. The finding is valid hardening guidance, but the omission of persist-credentials: false is pre-existing — it was absent on the prior v4.3.1 checkout pin too, not introduced by this Renovate version-bump PR. Keeping this PR scoped to the action version bumps and SHA pinning of dependency-review-action + fsfe/reuse image. A separate chore(security): harden checkout calls PR will address all checkout invocations missing the flag (codeql.yml already has it; 7 others remain across this list of files). Not blocking this PR's merge.
There was a problem hiding this comment.
@williaby, understood — the gap is pre-existing and out of scope for a Renovate version-bump PR. Keeping the change set focused is the right call.
Would you like me to open a GitHub issue to track the follow-up chore(security): harden checkout calls work? I can capture the 7 affected workflow files (excluding codeql.yml which already has the flag) and link back to this PR for context.
✏️ Learnings added
Learnt from: williaby
Repo: ByronWilliamsCPA/rag-processor PR: 19
File: .github/workflows/pr-validation.yml:55-57
Timestamp: 2026-05-21T04:02:06.311Z
Learning: In the ByronWilliamsCPA/rag-processor repository, `persist-credentials: false` is missing from `actions/checkout` steps in 7 workflow files (all except `.github/workflows/codeql.yml`, which already has it). This is a pre-existing gap, not introduced by any specific PR. A dedicated follow-up PR (`chore(security): harden checkout calls`) is planned to address all remaining occurrences.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
| - name: Checkout | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find .github/workflows -name "release-sign.yml" -type fRepository: ByronWilliamsCPA/rag-processor
Length of output: 109
🏁 Script executed:
cat -n .github/workflows/release-sign.ymlRepository: ByronWilliamsCPA/rag-processor
Length of output: 3549
Disable checkout credential persistence in the signing job.
Line 25 should set persist-credentials: false, especially with write-scoped token permissions in this job. The workflow uses explicit GH_TOKEN from secrets in downstream steps, so checkout credentials do not need to persist.
🔒 Suggested fix
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 24-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release-sign.yml around lines 24 - 25, The checkout step
uses actions/checkout@de0fac2e... but currently leaves credentials persisted;
update the Checkout step (the actions/checkout invocation) to set
persist-credentials: false so the checkout action does not inject or persist the
workflow token (GH_TOKEN) into the workspace for the signing job; this change
should be applied to the existing Checkout step in the release-sign workflow
where actions/checkout is used.
There was a problem hiding this comment.
Deferred to a follow-up PR. The finding is valid hardening guidance, but the omission of persist-credentials: false is pre-existing — it was absent on the prior v4.3.1 checkout pin too, not introduced by this Renovate version-bump PR. Keeping this PR scoped to the action version bumps and SHA pinning of dependency-review-action + fsfe/reuse image. A separate chore(security): harden checkout calls PR will address all checkout invocations missing the flag (codeql.yml already has it; 7 others remain across this list of files). Not blocking this PR's merge.
There was a problem hiding this comment.
@williaby, understood — the finding predates this PR and keeping the Renovate bump scoped is the right call. Would you like me to open a GitHub issue to track the chore(security): harden checkout calls work? I can file it now with a reference back to this PR and list the seven workflow files that still need persist-credentials: false.
✏️ Learnings added
Learnt from: williaby
Repo: ByronWilliamsCPA/rag-processor PR: 19
File: .github/workflows/release-sign.yml:24-25
Timestamp: 2026-05-21T04:02:09.835Z
Learning: In the ByronWilliamsCPA/rag-processor repository, `persist-credentials: false` is already set on the `actions/checkout` step in `.github/workflows/codeql.yml`. The following workflow files are missing it and are tracked for a follow-up hardening PR (`chore(security): harden checkout calls`): `cifuzzy.yml`, `dependency-review.yml`, `fips-compatibility.yml`, `performance-regression.yml`, `pr-validation.yml`, `release-sign.yml`, `reuse.yml`, and `slsa-provenance.yml`.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
| - name: Checkout repository | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/reuse.yml | sed -n '20,60p'Repository: ByronWilliamsCPA/rag-processor
Length of output: 1591
Add persist-credentials: false to both checkout actions.
Both lines 29 and 52 are missing the credential persistence hardening flag required for secure secret handling in GitHub Actions workflows.
Suggested fix
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout repository | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 28-29: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/reuse.yml around lines 28 - 29, Update both Checkout steps
that use actions/checkout (the step named "Checkout repository" and the other
checkout step later) to include the security flag persist-credentials: false
under the step to prevent automatic credential persistence; locate the steps
that reference uses: actions/checkout@de0fac2e4500d... and the second
actions/checkout occurrence and add persist-credentials: false as a top-level
key in each step.
There was a problem hiding this comment.
Deferred to a follow-up PR. The finding is valid hardening guidance, but the omission of persist-credentials: false is pre-existing — it was absent on the prior v4.3.1 checkout pin too, not introduced by this Renovate version-bump PR. Keeping this PR scoped to the action version bumps and SHA pinning of dependency-review-action + fsfe/reuse image. A separate chore(security): harden checkout calls PR will address all checkout invocations missing the flag (codeql.yml already has it; 7 others remain across this list of files). Not blocking this PR's merge.
There was a problem hiding this comment.
@williaby, understood — the finding is pre-existing and keeping this PR scoped to the version bumps is the right call. Thanks for the clear context on codeql.yml already being hardened.
Would you like me to open a GitHub issue to track the follow-up chore(security): harden checkout calls work? I can include the list of the 7 affected workflow files and a backlink to this PR so nothing gets lost.
✏️ Learnings added
Learnt from: williaby
Repo: ByronWilliamsCPA/rag-processor PR: 19
File: .github/workflows/reuse.yml:28-29
Timestamp: 2026-05-21T04:02:10.387Z
Learning: In the ByronWilliamsCPA/rag-processor repository, `persist-credentials: false` is already set in `.github/workflows/codeql.yml` checkout steps but is missing from 7 other workflow files: `cifuzzy.yml`, `dependency-review.yml`, `fips-compatibility.yml`, `performance-regression.yml`, `pr-validation.yml`, `release-sign.yml`, and `reuse.yml`. A dedicated follow-up PR (`chore(security): harden checkout calls`) is planned to address all remaining checkout invocations missing the flag. Do not flag this as a new issue in PRs that are purely version-bump changes; it is pre-existing.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
PR ReviewCI is green and every action is SHA-pinned with a version comment. No Critical findings. A small number of Important items below are worth addressing before merge; one Suggested item is intentionally deferred to a follow-up. Important (should fix)
Suggested (defer to follow-up PR)
Operational notes
Copilot ruleset review and CodeRabbit have already posted inline comments; the SonarCloud quality gate passed. 🤖 Generated with Claude Code |
Address PR review feedback from Copilot on PR #19: - actions/dependency-review-action: replace mutable @v4 tag with SHA pin 2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0 to match the repo's SHA-pinning convention used by every other action in the workflows. - fsfe/reuse Docker image: replace mutable :latest tag with 6.2.0@sha256:85462a75c0f8efda09ddd190b92816b70e7662577c8427429e11e1b9f25a992e for reproducibility and supply-chain safety. The 6.2.0 tag digest currently matches the :latest digest, so this preserves semantics while making the pull immutable. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
williaby
force-pushed
the
renovate/major-github-actions
branch
from
575d536 to
ae82201
Compare
✅ Performance Regression CheckStatus: PERFORMANCE OK
Threshold: +/-10% allowed regression ✅ Performance is within acceptable range. Additional Metrics
About Performance Regression TestingThis automated check compares
To reproduce locally: uv run --frozen python scripts/benchmark.py --iterations 1000 |
|
PR Fix SummaryApplied via Changes pushed (force-push to
PR description updated: Pre-commit verification: All hooks passed locally, including Deferred to a separate follow-up PR (
Operational notes:
🤖 Generated with Claude Code |
Summary
Multi-major version sweep of 10 GitHub Actions used across CI, security,
and release workflows. All actions are SHA-pinned with
# vX.Y.Zcommentsper repo convention.
Two follow-up fixes applied on top of Renovate's commit (see review thread):
actions/dependency-review-actionpinned by SHA (was using the mutable@v4tag, inconsistent with the rest of the repo).fsfe/reuseDocker image pinned to6.2.0@sha256:...digest (was usingthe mutable
:latesttag).Why
This is NOT a patch update. The PR performs multiple major version
upgrades, including:
actions/checkoutv4.3.1 → v6.0.2 (skips v5; runtime now requires Node 24)actions/upload-artifactv4.6.2 → v7.0.1 (3 majors; artifact-naming anduniqueness behavior changed in v4 baseline)
actions/github-scriptv7.1.0 → v9.0.0 (2 majors; skips v8)astral-sh/setup-uvv4.2.0 → v8.1.0 (4 majors)actions/attest-build-provenancev1.5.2 → v4.1.0 (3 majors)github/codeql-actionv3.35.5 → v4.35.5 (1 major)sigstore/cosign-installerv3.10.1 → v4.1.2 (1 major)fsfe/reuse-actionv4.0.0 → v6.0.0 (2 majors; skips v5)lycheeverse/lychee-actionv1.10.0 → v2.8.0 (1 major)actions/setup-pythonv5.6.0 → v6.2.0 (1 major)PR-time CI exercises most workflows and is green, but three workflows only
run on release or schedule events (
release-sign.yml,slsa-provenance.ymlbuild job,
cifuzzy.yml) and were not exercised by this PR's CI. Watch thenext release closely.
A separate
chore(security): harden checkout calls with persist-credentials: falsefollow-up PR is recommended (CodeRabbit/zizmor flagged 7 checkouts; pre-existing
omission, intentionally out of scope here).
Changes
This PR contains the following updates:
v1.5.2→v4.1.0v4.3.1→v6.0.2v7.1.0→v9.0.0v5.6.0→v6.2.0v4.6.2→v7.0.1v4.2.0→v8.1.0v4.0.0→v6.0.0v3.35.5→v4.35.5v1.10.0→v2.8.0v3.10.1→v4.1.2Warnings (1)
Please correct - or verify that you can safely ignore - these warnings before you merge this PR.
actions/attest-build-provenance: Could not determine new digest for update (github-tags package actions/attest-build-provenance)Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Impact
Acceptance Criteria
Testing
Notes
Release Notes
actions/attest-build-provenance (actions/attest-build-provenance)
v4.1.0Compare Source
What's Changed
actions/attestfrom 4.0.0 to 4.1.0 by @bdehamer in #838@actions/attestfrom 3.0.0 to 3.1.0 by @bdehamer in actions/attest#362@actions/attestfrom 3.1.0 to 3.2.0 by @bdehamer in actions/attest#365subject-versioninput for inclusion in storage record by @bdehamer in actions/attest#364Full Changelog: actions/attest-build-provenance@v4.0.0...v4.1.0
v4.0.0Compare Source
What's Changed
Full Changelog: actions/attest-build-provenance@v3.2.0...v4.0.0
v3.2.0Compare Source
What's Changed
Full Changelog: actions/attest-build-provenance@v3.1.0...v3.2.0
v3.1.0Compare Source
What's Changed
New Contributors
Full Changelog: actions/attest-build-provenance@v3...v3.1.0
v3.0.0Compare Source
What's Changed
v2.327.1
Release Notes
Make sure your runner is updated to this version or newer to use this release.
Full Changelog: actions/attest-build-provenance@v2.4.0...v3.0.0
v2.4.0Compare Source
What's Changed
Full Changelog: actions/attest-build-provenance@v2.3.0...v2.4.0
v2.3.0Compare Source
What's Changed
actions/attestfrom 2.2.1 to 2.3.0 by @bdehamer in #615@sigstore/ocifrom 0.4.0 to 0.5.0Full Changelog: actions/attest-build-provenance@v2.2.3...v2.3.0
v2.2.3Compare Source
What's Changed
Full Changelog: actions/attest-build-provenance@v2.2.2...v2.2.3
v2.2.2Compare Source
What's Changed
workflow.reffield from therefclaim in the OIDC token (actions/toolkit#1969)Full Changelog: actions/attest-build-provenance@v2.2.1...v2.2.2
v2.2.1Compare Source
What's Changed
@actions/attestv1.6.0Full Changelog: actions/attest-build-provenance@v2.2.0...v2.2.1
v2.2.0Compare Source
What's Changed
subject-checksumsinput parameterFull Changelog: actions/attest-build-provenance@v2.1.0...v2.2.0
v2.1.0Compare Source
What's Changed
attestation-idandattestation-urloutputs by @bdehamer in #415Full Changelog: actions/attest-build-provenance@v2.0.1...v2.1.0
v2.0.1Compare Source
What's Changed
Full Changelog: actions/attest-build-provenance@v2.0.0...v2.0.1
actions/checkout (actions/checkout)
v6.0.2Compare Source
v6.0.1Compare Source
v6.0.0Compare Source
v5.0.1Compare Source
v5.0.0Compare Source
actions/github-script (actions/github-script)
v9.0.0Compare Source
New features:
getOctokitfactory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients withgetOctokitfor details and examples.ACTIONS_ORCHESTRATION_IDenvironment variable is automatically appended to the user-agent string for request tracing.Breaking changes:
require('@​actions/github')no longer works in scripts. The upgrade to@actions/githubv9 (ESM-only) meansrequire('@​actions/github')will fail at runtime. If you previously used patterns likeconst { getOctokit } = require('@​actions/github')to create secondary clients, use the new injectedgetOctokitfunction instead — it's available directly in the script context with no imports needed.getOctokitis now an injected function parameter. Scripts that declareconst getOctokit = ...orlet getOctokit = ...will get aSyntaxErrorbecause JavaScript does not allowconst/letredeclaration of function parameters. Use the injectedgetOctokitdirectly, or usevar getOctokit = ...if you need to redeclare it.@actions/githubinternals beyond the standardgithub/octokitclient, you may need to update those references for v9 compatibility.What's Changed
New Contributors
Full Changelog: actions/github-script@v8.0.0...v9.0.0
v8.0.0Compare Source
actions/setup-python (actions/setup-python)
v6.2.0Compare Source
What's Changed
Dependency Upgrades
/__tests__/databy @dependabot in #1253 and #1264Full Changelog: actions/setup-python@v6...v6.2.0
v6.1.0Compare Source
What's Changed
Enhancements:
pip-installinput by @gowridurgad in #1201Dependency and Documentation updates:
allow-prereleasesby @yarikoptic in #979New Contributors
Full Changelog: actions/setup-python@v6...v6.1.0
v6.0.0Compare Source
What's Changed
Breaking Changes
Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes
Enhancements:
pip-versionby @priyagupta108 in #1129Bug fixes:
Dependency updates:
New Contributors
Full Changelog: actions/setup-python@v5...v6.0.0
actions/upload-artifact (actions/upload-artifact)
v7.0.1Compare Source
What's Changed
Full Changelog: actions/upload-artifact@v7...v7.0.1
v7.0.0Compare Source
v7 What's new
Direct Uploads
Adds support for uploading single files directly (unzipped). Callers can set the new
archiveparameter tofalseto skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. Thenameparameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.ESM
To support new versions of the
@actions/*packages, we've upgraded the package to ESM.What's Changed
New Contributors
Full Changelog: actions/upload-artifact@v6...v7.0.0
v6.0.0Compare Source
v6 - What's new
Node.js 24
This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.
What's Changed
Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0
v5.0.0Compare Source
What's Changed
BREAKING CHANGE: this update supports Node
v24.x. This is not a breaking change per-se but we're treating it as such.@actions/artifacttov4.0.0v5.0.0by @danwkennedy in #734New Contributors
Full Changelog: actions/upload-artifact@v4...v5.0.0
astral-sh/setup-uv (astral-sh/setup-uv)
v8.1.0: 🌈 New inputno-projectCompare Source
Changes
This add the a new boolean input
no-project.It only makes sense to use in combination with
activate-environment: trueand will append--no projectto theuv venvcall. This is for example useful if you have a pyproject.toml file with parts unparseable by uv🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v8.0.0: 🌈 Immutable releases and secure tagsCompare Source
This is the first immutable release of
setup-uv🥳All future releases are also immutable, if you want to know more about what this means checkout the docs.
This release also has two breaking changes
New format for
manifest-fileThe previously deprecated way of defining a custom version manifest to control which
uvversions are available and where to download them from got removed. The functionality is still there but you have to use the new format.No more major and minor tags
To increase security even more we will stop publishing minor tags. You won't be able to use
@v8or@v8.0any longer. We do this because pinning to major releases opens up users to supply chain attacks like what happened to tj-actions.🚨 Breaking changes
🧰 Maintenance
v7.6.0: 🌈 Fetch uv from Astral's mirror by defaultCompare Source
Changes
We now default to download uv from
releases.astral.sh.This means by default we don't hit the GitHub API at all and shouldn't see any rate limits and timeouts any more.
🚀 Enhancements
🧰 Maintenance
⬆️ Dependency updates
v7.5.0: 🌈 Use `astral-sh/versions` as version providerCompare Source
No more rate-limits
This release addresses a long-standing source of timeouts and rate-limit failures in setup-uv.
Previously, the action resolved version identifiers like 0.5.x by iterating over available uv releases via the GitHub API to find the best match. In contrast, latest and exact versions such as 0.5.0 skipped version resolution entirely and downloaded uv directly.
The
manifest-fileinput was an earlier attempt to improve this. It allows providing an url to a file that lists available versions, checksums, and even custom download URLs. The action also shipped with such a manifest.However, because that bundled file could become outdated whenever new uv releases were published, the action still had to fall back to the GitHub API in many cases.
This release solves the problem by sourcing version data from Astral’s versions repository via the raw content endpoint:
https://raw.githubusercontent.com/astral-sh/versions/refs/heads/main/v1/uv.ndjson
By using the raw endpoint instead of the GitHub API, version resolution no longer depends on API authentication and is much less likely to run into rate limits or timeouts.
The
manifest-fileinput lets you override that source with your own URL, for example to test custom uv builds or alternate download locations.The manifest file must be in NDJSON format, where each line is a JSON object representing a version and its artifacts. For example:
{"version":"0.10.7","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://example.com/uv-x86_64-unknown-linux-gnu.tar.gz","archive_format":"tar.gz","sha256":"..."}]} {"version":"0.10.6","artifacts":[{"platform":"x86_64-unknown-linux-gnu","variant":"default","url":"https://example.com/uv-x86_64-unknown-linux-gnu.tar.gz","archive_format":"tar.gz","sha256":"..."}]}Changes
🚀 Enhancements
📚 Documentation
v7.4.0: 🌈 Add riscv64 architecture support to platform detectionCompare Source
Changes
Thank you @luhenry for adding support for riscv64 arch
🚀 Enhancements
🧰 Maintenance
⬆️ Dependency updates
v7.3.1: 🌈 fall back to VERSION_CODENAME when VERSION_ID is not availableCompare Source
Changes
This release adds support for running in containers like
debian:testingordebian:unstable🐛 Bug fixes
🧰 Maintenance
⬆️ Dependency updates
v7.3.0: 🌈 New features and bug fixes for activate-environmentCompare Source
Changes
This release contains a few bug fixes and a new feature for the activate-environment functionality.
🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v7.2.1: 🌈 update known checksums up to 0.9.28Compare Source
Changes
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v7.2.0: 🌈 add outputs python-version and python-cache-hitCompare Source
Changes
Among some minor typo fixes and quality of life features for developers of actions the m
Configuration
📅 Schedule: Branch creation - "after 10pm every weekday,before 5am every weekday,every weekend" in timezone America/New_York, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Renovate Bot.