chore(deps)!: Update GitHub Actions (major) by williaby · Pull Request #30 · ByronWilliamsCPA/DeQA-Doc

williaby · 2026-05-12T02:09:17Z

Summary

Why

Scheduled patch update, bug fixes and security patches with no API changes.

Changes

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
actions/checkout	action	major	`v6.0.2` → `v7.0.0`
actions/dependency-review-action	action	major	`v4.9.0` → `v5.0.0`

Impact

✅ Patch update: bug fixes and security patches only
✅ No breaking changes

Acceptance Criteria

All CI checks pass

Testing

CI gates pass (tests, lint, type checking, security scan)

Notes

Release Notes

actions/checkout (actions/checkout)

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v7`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

actions/dependency-review-action (actions/dependency-review-action)

`v5.0.0`: 5.0.0

Compare Source

This is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version v2.327.1 to run.

What's Changed

Add .github/copilot-instructions.md for Copilot coding agent by @ahpook in #1067
Update Node.js runtime from 20 to 24 by @scottschreckengaust in #1084
Bump spdx-license-ids from 3.0.20 to 3.0.23 by @mongolyy in #1091
docs: bump actions/checkout from v4 to v6 in workflow examples by @Marukome0743 in #1077
fix: patched version display for advisories with non-strict semver ranges (e.g. Maven beta versions) by @tspascoal in #1076
Resolve security findings by @AshelyTC in #1094
v5.0.0 release branch by @ahpook in #1098

New Contributors

@scottschreckengaust made their first contribution in #1084
@mongolyy made their first contribution in #1091
@Marukome0743 made their first contribution in #1077

Full Changelog: actions/dependency-review-action@v4.9.0...v5.0.0

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- "after 10pm every weekday,before 5am every weekday,every weekend"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

coderabbitai · 2026-05-12T02:09:24Z

Warning

Review limit reached

@williaby, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 53 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1424e705-bbd4-4df5-a327-78d78958a436

📥 Commits

Reviewing files that changed from the base of the PR and between c7e7593 and f5674ee.

📒 Files selected for processing (4)

.github/workflows/ci.yml
.github/workflows/codeql.yml
.github/workflows/dependency-review.yml
.github/workflows/reuse.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch renovate/major-github-actions

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-05-12T02:09:40Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package

Version

Score

Details

actions/actions/checkout

9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0

🟢 6.9

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	16 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Packaging	⚠️ -1	packaging workflow not detected
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 9	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
SAST	🟢 10	SAST tool is run on all commits

Scanned Files

.github/workflows/reuse.yml

sonarqubecloud · 2026-05-12T02:10:18Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot

Pull request overview

Updates the repository’s dependency review GitHub Actions workflows to use actions/dependency-review-action v5, keeping the action pinned to a specific commit SHA.

Changes:

Bump actions/dependency-review-action from v4.9.0 to v5.0.0 in the dedicated dependency review workflow.
Bump actions/dependency-review-action from v4.9.0 to v5.0.0 in the CI workflow’s dependency review job.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
`.github/workflows/dependency-review.yml`	Updates dependency review action to v5 (pinned SHA).
`.github/workflows/ci.yml`	Updates dependency review action to v5 (pinned SHA) in CI.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

      - name: Dependency Review
-        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:


sonarqubecloud · 2026-06-29T18:00:16Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot AI review requested due to automatic review settings May 12, 2026 02:09

williaby added breaking-change dependencies labels May 12, 2026

Copilot started reviewing on behalf of williaby May 12, 2026 02:09 View session

Copilot AI reviewed May 12, 2026

View reviewed changes

Comment thread .github/workflows/dependency-review.yml

Comment on lines 26 to 28

- name: Dependency Review

uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0

uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

with:

williaby force-pushed the renovate/major-github-actions branch from c139adc to 0d1ff50 Compare June 20, 2026 20:08

williaby changed the title ~~chore(deps)!: Update GitHub Actions to v5~~ chore(deps)!: Update GitHub Actions (major) Jun 20, 2026

chore(deps)!: Update GitHub Actions

f5674ee

williaby force-pushed the renovate/major-github-actions branch from 0d1ff50 to f5674ee Compare June 29, 2026 17:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps)!: Update GitHub Actions (major)#30

chore(deps)!: Update GitHub Actions (major)#30
williaby wants to merge 1 commit into
mainfrom
renovate/major-github-actions

williaby commented May 12, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented May 12, 2026 •

edited

Loading

Review limit reached

Uh oh!

github-actions Bot commented May 12, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented May 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

sonarqubecloud Bot commented Jun 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

williaby commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Changes

Impact

Acceptance Criteria

Testing

Notes

Release Notes

v7.0.0

v7

v6.0.3

v5.0.0: 5.0.0

What's Changed

New Contributors

Configuration

Uh oh!

coderabbitai Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

github-actions Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

sonarqubecloud Bot commented May 12, 2026

Quality Gate passed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

sonarqubecloud Bot commented Jun 29, 2026

Quality Gate passed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

williaby commented May 12, 2026 •

edited

Loading

`v7.0.0`

`v7`

`v6.0.3`

`v5.0.0`: 5.0.0

coderabbitai Bot commented May 12, 2026 •

edited

Loading

github-actions Bot commented May 12, 2026 •

edited

Loading