You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #4205
The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #4148
Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #4206
The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198
Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #4188
Update default CodeQL bundle version to 2.27.2. #4203
Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #4184
This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.
For changes to checks and results, and what the infrastructure move means for you, see the Scorecard v5.6.0 release notes.
The action's container image is built with Go 1.27.2 on a refreshed distroless base. by @justaugustus in #1716
The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still
recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @justaugustus in #1716
The Scorecard version in results now always matches the Scorecard release the action is built
with. by @justaugustus in #1718
The action no longer prints the GitHub token variable while validating its options. by @arpitjain099 in #1709
results_format accepts intoto, which wraps the JSON results in an in-toto attestation
statement. by @puerco in #1702
The pull request updates pinned reusable workflow and action revisions across CI, security, release, and website workflows. It also updates the Go version check action pin.
The workflows update pinned revisions for Harden Runner, CodeQL, Scorecard, and the Go version check action. Other workflow behavior remains unchanged.
This PR updates pinned GitHub Actions revisions without introducing an identified merge-blocking workflow risk.
Pre-merge checks: 5
Check name
Status
Explanation
Title check
The title clearly identifies the main change: updating GitHub Actions dependencies.
Description check
The description documents the updated dependencies, versions, release notes, and Renovate configuration. It does not use the template's What, Why, or Tickets headings, but it provides sufficient chang…
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Description check
Explanation
The description documents the updated dependencies, versions, release notes, and Renovate configuration. It does not use the template's What, Why, or Tickets headings, but it provides sufficient change context.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (8 skipped: 8 unsupported.)
Finishing Touches
🧪 Generate unit tests (beta)
Commit to this branch
Create a new PR
Warning
Some tools did not complete. Review the errors below.
actionlint (1.7.12)
.github/workflows/release.yaml
/usr/bin/shellcheck --norc -f json -x --shell bash -e SC1091,SC2194,SC2050,SC2153,SC2154,SC2157,SC2043 - did not run successfully while checking script at line:185,col:9: /usr/bin/shellcheck exited with status 1 but stdout was empty. stderr: "shellcheck: src/ShellCheck/Analytics.hs:4009:5-93: Non-exhaustive patterns in function checkCmd\n\n"
Comment @coderabbitai help to get the list of available commands.
Routine renovate[bot] action version-bump across 8 CI workflow files; protected-path and CI-change signals add modest risk, but the bot authorship, small diff, and no dependency changes keep this at moderate.
[protected-path].github/workflows/ — All 8 changed files are under the .github/ protected path prefix: auto-merge.yaml, benchmark.yaml, checks-codecov.yaml, codeql.yaml, lint.yaml, release.yaml, scorecard.yml, website.yaml. This PR has no linked issue providing justification for modifying governance and infrastructure files. Human approval is required for all protected-path changes.
Labels: PR updates GitHub Actions workflow files and CI configuration.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
fullsend-ai-review
Bot
added
github_actions
This PR contains the following updates:
837d70f→9e47833837d70f→9e47833v4.38.2→v4.39.1v2.4.4→v2.5.0v2.21.1→v2.22.2v2.22.3Release Notes
github/codeql-action
v4.39.1Compare Source
v4.39.0Compare Source
codeql-action/analyzestep now validates that a correct argument for thecheckout_pathinput has been provided. Thecheckout_pathinput must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used bycodeql-action/init, then the CodeQL Action now produces a warning. #4148codeql-action/start-proxystep that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic ascodeql-action/init. This primarily benefits customers who are using GitHub instances other thangithub.comwhere thecodeql-action/start-proxystep may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #4198v4.38.3Compare Source
ossf/scorecard-action
v2.5.0Compare Source
What's Changed
This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.
For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.
@justaugustus in #1716
cmd/installer) now creates.github/workflows/scorecard.yml, and stillrecognizes existing
scorecards.ymlandscorecards-analysis.ymlworkflows. by @justaugustus in #1716with. by @justaugustus in #1718
@arpitjain099 in #1709
results_formatacceptsintoto, which wraps the JSON results in an in-toto attestationstatement. by @puerco in #1702
Other
RELEASE.md by @justaugustus in #1716
New Contributors
Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0
step-security/harden-runner
v2.22.2Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.22.1...v2.22.2
v2.22.1Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.22.0...v2.22.1
v2.22.0Compare Source
What's Changed
Full Changelog: step-security/harden-runner@v2.21.1...v2.22.0
Configuration
📅 Schedule: (UTC)
* 0-3 * * *)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.