chore(deps): bump the github-actions-deps group across 1 directory with 2 updates#144
Conversation
dependabot
Bot
added
dependencies
|
|
Up to standards ✅🟢 Issues
|
dependabot
Bot
force-pushed
the
dependabot/github_actions/github-actions-deps-5763307931
branch
from
c55e4f7 to
745ceda
Compare
dependabot
Bot
force-pushed
the
dependabot/github_actions/github-actions-deps-5763307931
branch
from
745ceda to
7c31693
Compare
📝 WalkthroughWalkthroughWorkflow YAML updates: ChangesGitHub Actions Dependency Version Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codacy-coverage-reporter.yaml:
- Line 26: The workflow step "Cache dependencies" is using the mutable tag
`actions/cache@v5`; update that `uses:` entry to pin to the full commit SHA for
the v5 release (replace `actions/cache@v5` with
`actions/cache@<full-commit-sha>`). Locate the commit SHA by opening the
actions/cache repository tags/releases for v5 and copy the full 40-char commit
SHA, then update the workflow entry so the "Cache dependencies" step uses that
SHA; commit the change to ensure the action is immutably pinned.
In @.github/workflows/go.yml:
- Line 99: Replace mutable tag-based GitHub Action refs with immutable commit
SHAs: find the action references like actions/cache@v5,
codecov/codecov-action@v6.0.1 and any other tag refs in the workflow (the
occurrences flagged such as the refs around those symbols) and update them to
use the corresponding full commit SHA from each action's repository (eg
actions/cache@<full-commit-sha>); fetch the exact commit SHAs from the upstream
action repos or GitHub Marketplace, verify compatibility, and commit the updated
refs so every use of those action identifiers is pinned to a specific immutable
SHA.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: cdcfb64b-cd91-46d3-b35a-33f7e8e3407f
📒 Files selected for processing (2)
.github/workflows/codacy-coverage-reporter.yaml.github/workflows/go.yml
|
|
||
| - name: Cache dependencies | ||
| uses: actions/cache@v4 | ||
| uses: actions/cache@v5 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
repo="actions/cache"
tag="v5"
ref_json="$(curl -fsSL "https://api.github.com/repos/${repo}/git/ref/tags/${tag}")"
obj_type="$(jq -r '.object.type' <<<"$ref_json")"
obj_sha="$(jq -r '.object.sha' <<<"$ref_json")"
if [ "$obj_type" = "tag" ]; then
commit_sha="$(curl -fsSL "https://api.github.com/repos/${repo}/git/tags/${obj_sha}" | jq -r '.object.sha')"
else
commit_sha="$obj_sha"
fi
printf '%s@%s -> %s\n' "$repo" "$tag" "$commit_sha"Repository: kubeservice-stack/common
Length of output: 118
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the relevant workflow lines around the referenced line
sed -n '1,120p' .github/workflows/codacy-coverage-reporter.yaml | nl -ba | sed -n '1,120p'
# Extract any actions/cache usage from the workflow
rg -n "uses:\s*actions/cache@" .github/workflows/codacy-coverage-reporter.yaml || true
# Check whether any workflows pin actions/cache to a SHA elsewhere in the repo
rg -n "uses:\s*actions/cache@" .github/workflows || trueRepository: kubeservice-stack/common
Length of output: 111
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow head (for line context) =="
cat -n .github/workflows/codacy-coverage-reporter.yaml | sed -n '1,120p'
echo
echo "== actions/cache usage in this workflow =="
rg -n "uses:\s*actions/cache@" .github/workflows/codacy-coverage-reporter.yaml || true
echo
echo "== actions/cache usage elsewhere in repo (workflows only) =="
rg -n "uses:\s*actions/cache@" .github/workflows || trueRepository: kubeservice-stack/common
Length of output: 1866
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n "unpinned-uses" . || true
rg -n "pinned.*uses|pin.*uses|hardening for github actions|security hardening|retargeting" .github README* docs* || trueRepository: kubeservice-stack/common
Length of output: 114
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== repo root =="
ls -la
echo
echo "== search: unpinned-uses =="
rg -n "unpinned-uses" . || true
echo
echo "== search: hardening/pinning/retargeting keywords =="
rg -n "unpinned|pinned.*uses|pin.*uses|retarget|tag retarget|security hardening|hardening for github actions|hardening.*actions" . || true
echo
echo "== search: any policy/config files mentioning actions security/hardening =="
fd -e yml -e yaml -e json -e md -e toml -e config . | wc -l >/dev/null
fd -e yml -e yaml -e json -e toml -e md -e config . | rg -n "(policy|security|hardening|action|github|workflow)" || trueRepository: kubeservice-stack/common
Length of output: 1159
🌐 Web query:
GitHub Actions security hardening unpinned-uses policy enforce full-length commit SHA for actions at org repo level
💡 Result:
GitHub provides an organization-level policy to enforce the use of full-length commit SHAs for GitHub Actions [1][2]. This security control helps mitigate supply chain risks by ensuring that workflows execute immutable versions of actions, preventing attacks where malicious code is injected into mutable references like tags or branches [1][3][4]. Policy Configuration To enable this enforcement, organization owners can navigate to Organization Settings > Actions > General > Policies [5]. Within this section, there is a setting labeled "Require actions to be pinned to a full-length commit SHA" [1][6]. When enabled, any workflow that attempts to use an action not pinned to a full-length (40-character) commit SHA will fail [2][5]. Key Considerations for Enforcement: - Scope: This policy applies to direct 'uses' references in workflow files [5]. It is a critical component of a broader security hardening strategy but should be combined with other controls, as it does not inherently verify transitive dependencies (e.g., actions that pull other mutable code at runtime) or automatically apply to reusable workflows in the same manner [4][5]. - Governance and Blocking: GitHub also allows for explicit allow and block lists for actions [2][6]. Administrators can combine these policies by using '!' to block specific actions or versions, and ',!owner/repo@' to control allowed action usage across the organization [6][7]. - Complementary Practices: Because SHA pinning alone does not guarantee that an action's internal dependencies or execution logic are immutable, security experts recommend additional practices such as: - Enabling Dependabot to manage and update SHA-pinned actions [2][3]. - Conducting periodic drift audits to identify when upstream maintainers update tags [5]. - Utilizing additional runtime security tools (e.g., harden-runner) to monitor egress traffic or token exposure [4][5]. - Implementing pre-commit hooks or linting (e.g., actionlint) to catch non-compliant references before they are pushed to the repository [5].
Citations:
- 1: https://docs.github.com/en/actions/reference/security/secure-use
- 2: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
- 3: https://github.com/kubernetes/community/blob/main/github-management/github-actions-policy.md
- 4: https://mikael.barbero.tech/blog/post/2026-03-24-stop-trusting-mutable-references/
- 5: https://www.systemshardening.com/articles/cicd/github-actions-reusable-workflow-pinning-audit/
- 6: https://githubdocs.cn/en/enterprise-cloud@latest/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise
- 7: https://github.com/github/docs/blob/main/content/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise.md
Pin actions/cache to a full commit SHA
The workflow step Cache dependencies uses the mutable tag actions/cache@v5 (line 26). Tags can be retargeted; GitHub’s hardening guidance recommends pinning GitHub Actions to full-length commit SHAs (and org policy can enforce this). https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
uses: actions/cache@v5🧰 Tools
🪛 zizmor (1.25.2)
[error] 26-26: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 26-26: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default
(cache-poisoning)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codacy-coverage-reporter.yaml at line 26, The workflow
step "Cache dependencies" is using the mutable tag `actions/cache@v5`; update
that `uses:` entry to pin to the full commit SHA for the v5 release (replace
`actions/cache@v5` with `actions/cache@<full-commit-sha>`). Locate the commit
SHA by opening the actions/cache repository tags/releases for v5 and copy the
full 40-char commit SHA, then update the workflow entry so the "Cache
dependencies" step uses that SHA; commit the change to ensure the action is
immutably pinned.
|
|
||
| - name: Cache dependencies | ||
| uses: actions/cache@v4 | ||
| uses: actions/cache@v5 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
resolve_tag() {
local repo="$1"
local tag="$2"
local ref_json obj_type obj_sha commit_sha
ref_json="$(curl -fsSL "https://api.github.com/repos/${repo}/git/ref/tags/${tag}")"
obj_type="$(jq -r '.object.type' <<<"$ref_json")"
obj_sha="$(jq -r '.object.sha' <<<"$ref_json")"
if [ "$obj_type" = "tag" ]; then
commit_sha="$(curl -fsSL "https://api.github.com/repos/${repo}/git/tags/${obj_sha}" | jq -r '.object.sha')"
else
commit_sha="$obj_sha"
fi
printf '%s@%s -> %s\n' "$repo" "$tag" "$commit_sha"
}
resolve_tag "actions/cache" "v5"
resolve_tag "codecov/codecov-action" "v6.0.1"Repository: kubeservice-stack/common
Length of output: 118
Pin GitHub Action references to immutable commit SHAs.
In .github/workflows/go.yml, the workflow uses tag-based action refs at lines 99, 112, 135, and 151 (e.g., actions/cache@v5, codecov/codecov-action@v6.0.1). Tag refs are mutable; pinning to full commit SHAs provides stronger supply-chain hardening. (GitHub security hardening for GitHub Actions)
🧰 Tools
🪛 zizmor (1.25.2)
[error] 99-99: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/go.yml at line 99, Replace mutable tag-based GitHub Action
refs with immutable commit SHAs: find the action references like
actions/cache@v5, codecov/codecov-action@v6.0.1 and any other tag refs in the
workflow (the occurrences flagged such as the refs around those symbols) and
update them to use the corresponding full commit SHA from each action's
repository (eg actions/cache@<full-commit-sha>); fetch the exact commit SHAs
from the upstream action repos or GitHub Marketplace, verify compatibility, and
commit the updated refs so every use of those action identifiers is pinned to a
specific immutable SHA.
…th 2 updates Bumps the github-actions-deps group with 2 updates in the / directory: [actions/cache](https://github.com/actions/cache) and [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `actions/cache` from 4 to 5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@v4...v5) Updates `codecov/codecov-action` from 6.0.0 to 7.0.0 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v6.0.0...v7.0.0) --- updated-dependencies: - dependency-name: actions/cache dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions-deps - dependency-name: codecov/codecov-action dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions-deps ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/github-actions-deps-5763307931
branch
from
7c31693 to
58573ad
Compare
|
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/go.yml (1)
151-151: Codecov config inconsistency inunittest-reportjob (usecover.out)
codecov/codecov-action@v7.0.0still runs with default coverage file discovery enabled, so the generatedcover.outfromunittest-reportshould be picked up even without awith:block. For consistency with theunittestjob and to avoid uploading unintended discovered artifacts, addwith: files: cover.out(and optionallyfail_ci_if_error: false; usedisable_search: trueif you want onlycover.out).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/go.yml at line 151, The Codecov step in the unittest-report job is running with default discovery which can pick up unintended artifacts; update the step that uses codecov/codecov-action@v7.0.0 (the Codecov action invocation in the unittest-report job) to include a with: block that specifies files: cover.out and optionally fail_ci_if_error: false (and set disable_search: true if you want to restrict uploading strictly to cover.out) so only the generated cover.out is uploaded consistently with the unittest job.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/go.yml:
- Line 151: The Codecov step in the unittest-report job is running with default
discovery which can pick up unintended artifacts; update the step that uses
codecov/codecov-action@v7.0.0 (the Codecov action invocation in the
unittest-report job) to include a with: block that specifies files: cover.out
and optionally fail_ci_if_error: false (and set disable_search: true if you want
to restrict uploading strictly to cover.out) so only the generated cover.out is
uploaded consistently with the unittest job.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 8dad0bed-b6f6-40ff-8f93-84d2fa77c181
📒 Files selected for processing (2)
.github/workflows/codacy-coverage-reporter.yaml.github/workflows/go.yml
1 participant
Bumps the github-actions-deps group with 2 updates in the / directory: actions/cache and codecov/codecov-action.
Updates
actions/cachefrom 4 to 5Release notes
Sourced from actions/cache's releases.
... (truncated)
Changelog
Sourced from actions/cache's changelog.
... (truncated)
Commits
27d5ce7Merge pull request #1747 from actions/yacaovsnc/update-dependencyf280785licensed changes619aeb1npm run build generated dist filesbcf16c2Update ts-http-runtime to 0.3.56682284Merge pull request #1738 from actions/prepare-v5.0.4e340396Update RELEASES8a67110Add licenses1865903Update dependencies & patch security vulnerabilities5656298Merge pull request #1722 from RyPeck/patch-14e380d1Fix cache key in examples.md for bun.lockUpdates
codecov/codecov-actionfrom 6.0.0 to 7.0.0Release notes
Sourced from codecov/codecov-action's releases.
Changelog
Sourced from codecov/codecov-action's changelog.
... (truncated)
Commits
fb8b358chore(release): 7.0.0 (#1957)ca0a928ci: remove Enforce License Compliance workflow (#1950)e79a696chore(release): 6.0.1 (#1949)51e6422fix: prevent template injection in run: steps (VULN-1652) (#1947)Summary by CodeRabbit