chore(deps)!: Update GitHub Actions (major) by williaby · Pull Request #37 · ByronWilliamsCPA/Unify

williaby · 2026-06-11T02:16:15Z

ℹ️ Note

This PR body was truncated due to platform limits.

Summary

Why

Scheduled patch update, bug fixes and security patches with no API changes.

Changes

This PR contains the following updates:

Package	Type	Update	Change
SonarSource/sonarqube-scan-action	action	major	`v4.0.0` → `v8.2.0`
actions/checkout	action	major	`v4.2.2` → `v7.0.0`
actions/dependency-review-action	action	major	`v4.5.0` → `v5.0.0`
actions/download-artifact	action	major	`v6.0.0` → `v8.0.1`
actions/github-script	action	major	`v7.0.1` → `v9.0.0`
actions/setup-python	action	major	`v5.3.0` → `v6.3.0`
actions/upload-artifact	action	major	`v4.5.0` → `v7.0.1`
astral-sh/setup-uv	action	major	`v7.1.1` → `v8.2.0`
fsfe/reuse-action	action	major	`v4.0.0` → `v6.0.0`
lycheeverse/lychee-action	action	major	`v1.10.0` → `v2.8.0`

Impact

✅ Patch update: bug fixes and security patches only
✅ No breaking changes

Acceptance Criteria

All CI checks pass

Testing

CI gates pass (tests, lint, type checking, security scan)

Notes

Release Notes

SonarSource/sonarqube-scan-action (SonarSource/sonarqube-scan-action)

`v8.2.0`

Compare Source

What's Changed

SQSCANGHA-149 Add scannerBinariesAuthHeader input by @henryju in #246
SQSCANGHA-88 Deprecate the SONARCLOUD_URL env variable support by @henryju in #249
SQSCANGHA-84 Remove outdated wget/curl references by @henryju in #248
SQSCANGHA-135 Fix scanner binaries always re-downloaded due to incompatible 4-part version by @henryju in #250
SQSCANGHA-127 Rename downloaded file to .zip before extraction on Windows by @henryju in #251

Full Changelog: SonarSource/sonarqube-scan-action@v8...v8.2.0

`v8.2`

Compare Source

`v8.1.0`

Compare Source

What's Changed

SQSCANGHA-146 Add proxy support for GPG keyserver access by @henryju in #244
SQSCANGHA-148 Update SonarScanner CLI to 8.1.0.6389 by @github-actions[bot] in #232

Full Changelog: SonarSource/sonarqube-scan-action@v8...v8.1.0

`v8.1`

Compare Source

`v8.0.0`

Compare Source

What's Changed

Breaking change

SQSCANGHA-145 Set skipSignatureVerification default value to false by @antoine-vinot-sonarsource in #241

Full Changelog: SonarSource/sonarqube-scan-action@v7...v8.0.0

What's Changed

SQSCANGHA-140 Set skipSignatureVerification default value to true to avoid breaking change by @gmmcal in #240

Full Changelog: SonarSource/sonarqube-scan-action@v7...v7.2.1

`v7.2.0`

Compare Source

What's Changed

SQSCANGHA-133 Upgrade the Node version used in UTs + contribution guide by @claire-villard-sonarsource in #226
SC-45750 Migrate to dateless license headers by @claire-villard-sonarsource in #229
SQSCANGHA-134 Upgrade the libraries to latest version by @claire-villard-sonarsource in #227
SQSCANGHA-138 Update dist and add ci test by @antoine-vinot-sonarsource in #233
SQSCANGHA-140 Add OpenPGP signature verification for scanner downloads by @claire-villard-sonarsource in #235

Full Changelog: SonarSource/sonarqube-scan-action@v7...v7.2.0

`v7.2`

Compare Source

`v7.1.0`

Compare Source

What's Changed

SQSCANGHA-128 NO-JIRA Bump actions/cache from 4 to 5 by @dependabot[bot] in #219
SQSCANGHA-130 Bump rollup from 4.50.1 to 4.59.0 by @dependabot[bot] in #221
SQSCANGHA-131 Bump picomatch from 4.0.3 to 4.0.4 by @dependabot[bot] in #223
SQSCANGHA-132 Upgrade Node to 24 by @claire-villard-sonarsource in #224

Full Changelog: SonarSource/sonarqube-scan-action@v7...v7.1.0

`v7.1`

Compare Source

`v7.0.0`

Compare Source

What's Changed

SQSCANGHA-120 NO-JIRA Bump actions/setup-node from 4 to 5 by @dependabot[bot] in #211
Update SonarScanner CLI to 7.3.0.5189 by @github-actions[bot] in #212
SQSCANGHA-122 Include caveats for running SCA by @subdavis in #213
SQSCANGHA-123 NO-JIRA Bump actions/setup-node from 5 to 6 by @dependabot[bot] in #214
SQSCANGHA-126 Update SonarScanner CLI to 8.0.1.6346 by @github-actions[bot] in #218

New Contributors

@subdavis made their first contribution in #213

Full Changelog: SonarSource/sonarqube-scan-action@v6.0.0...v7.0.0

`v7.0`

Compare Source

`v7`

Compare Source

`v6.0.0`

Compare Source

BREAKING CHANGE!

In order to prevent command-line injection, the actions has been rewritten from Bash to JS, and the args input is now parsed differently. When updating to v6, you might have to update your workflow to change how arguments are quoted.
For example, if you were previously passing:

- uses: SonarSource/sonarqube-scan-action@<action version>
  with:
    args: >
      -Dsonar.projectName="My Project"

you should now pass:

- uses: SonarSource/sonarqube-scan-action@<action version>
  with:
    args: >
      "-Dsonar.projectName=My Project"

For more args passing examples, please refer to the README file

What's Changed

SQSCANGHA-106 Migrate from Bash to JS by @jeremy-davis-sonarsource in #208

Full Changelog: SonarSource/sonarqube-scan-action@v5.3.1...v6.0.0

`v6.0`

Compare Source

`v6`

Compare Source

`v5.3.2`

Compare Source

Full Changelog: SonarSource/sonarqube-scan-action@v5.3.1...v5.3.2

`v5.3.1`

Compare Source

OVERLOOKED BREAKING CHANGE!

In order to prevent command-line injection, the way to parse the args input has been changed, but this is possibly a breaking change regarding support of quotes.

For example, if you were previously passing:

- uses: SonarSource/sonarqube-scan-action@<action version>
  with:
    args: >
      -Dsonar.projectName="My Project"

you should now pass:

- uses: SonarSource/sonarqube-scan-action@<action version>
  with:
    args: >
      "-Dsonar.projectName=My Project"

Edit: We have now released v6 that more accurately reflect this breaking change.

What's Changed

SQSCANGHA-101 Add more input injection tests by @aleksandra-bozhinoska-sonarsource in #200

New Contributors

@daantimmer made their first contribution in #199

Full Changelog: SonarSource/sonarqube-scan-action@v5...v5.3.1

`v5.3.0`

Compare Source

What's Changed

SQSCANGHA-83 Avoid unbound variable error on parameter expansion by @aleksandra-bozhinoska-sonarsource in #192
SQSCANGHA-97 Use /usr/bin/env for shebang by @eliandoran in #193
SQSCANGHA-98 Update SonarScanner CLI to 7.2.0.5079 by @github-actions[bot] in #196

New Contributors

@eliandoran made their first contribution in #193

Full Changelog: SonarSource/sonarqube-scan-action@v5.2.0...v5.3.0

`v5.3`

Compare Source

`v5.2.0`

Compare Source

What's Changed

SQSCANGHA-90 remove mend dead conf by @pierre-guillot-gh in #184
SQSCANGHA-89 Attempt to fix command injection by @henryju in #186
SQSCANGHA-93 Fix madhead/semver-utils' version by @csaba-feher-sonarsource in #187
SQSCANGHA-94 Update version update logic by @csaba-feher-sonarsource in #188
SQSCANGHA-92 Validate scanner version by @csaba-feher-sonarsource in #189

Full Changelog: SonarSource/sonarqube-scan-action@v5...v5.2.0

`v5.2`

Compare Source

`v5.1.0`

Compare Source

What's Changed

Update SonarScanner CLI to 7.1.0.4889 to support sonar.region=us by @github-actions in #183

Full Changelog: SonarSource/sonarqube-scan-action@v5.0.0...v5.1.0

`v5.1`

Compare Source

`v5.0.0`

Compare Source

What's Changed

SQSCANGHA-81 Update SonarScanner CLI to 7.0.2.4839 by @github-actions in #175

Full Changelog: SonarSource/sonarqube-scan-action@v4...v5.0.0

`v5.0`

Compare Source

`v5`

Compare Source

`v4.2.2`

Compare Source

Full Changelog: SonarSource/sonarqube-scan-action@v4.2.1...v4.2.2

`v4.2.1`

Compare Source

What's Changed

SQSCANGHA-77 Change title back to SonarQube Scan Action by @antonioaversa in #166

Full Changelog: SonarSource/sonarqube-scan-action@v4.2.0...v4.2.1

`v4.2.0`

Compare Source

We are happy to announce this new version of the GitHub action, which brings support for C, C++, and Objective-C projects.

The action supports both AutoConfig scenarios, as well as scenarios where Build Wrapper is required, and is a complete replacement of sonarqube-github-c-cpp and sonarcloud-github-c-cpp.

To install Build Wrapper, a new sonarqube-scan-action/install-build-wrapper sub-action is provided.

Check the README for examples of configuration.

On top of C, C++, and Objective-C support, we have also improved our support of self-hosted GitHub runners:

we don't expect anymore the temporary runner folder (RUNNER_TEMP) to be cleaned after every job execution: if present, the action will clean it, before running
similarly, we don't expect anymore the Sonar SSL folder (~/sonar/ssl) to be cleaned after every job execution: if present, the action will clean it, before running

What's Changed

SQSCANGHA-64 Shorten action description to respect 125 chars limit by @antonioaversa in #157
SQCPPGHA-9 Extend action to support C, C++, and Objective-C projects by @antonioaversa in #161
README: required programs for self-hosted and container by @trgalho in #162
Force unzip without prompt in sonar scanner installation when files already exist by @blgnksy in #163
SQSCANGHA-75 Support self-hosted runners not clearing temp after run by @antonioaversa in #164
SQSCANGHA-76 Support self-hosted runners not clearing truststore after run by @antonioaversa in #165

New Contributors

@trgalho made their first contribution in #162
@blgnksy made their first contribution in #163

Full Changelog: SonarSource/sonarqube-scan-action@v4.1.0...v4.2.0

`v4.2`

Compare Source

`v4.1.0`

Compare Source

The new version is now the official entrypoint for both Server and Cloud: a single GitHub action to interact with the SonarQube solution, whether on-premise or in the cloud!

It also brings several other improvements, including:

the ability to customize the location from where the SonarScanner CLI is downloaded, which can be useful when the runner is self-hosted and has regulated or no access to the Internet
the ability to use curl as a fallback when wget is not available in the environment of the runner
the requirement of the Java keytool to be available has been lifted

What's Changed

SQSCANGHA-51 Make Scanner CLI binaries URL customizable by @antonioaversa in #148
SQSCANGHA-55 Support GitHub self-hosted runners without wget by @antonioaversa in #151
SQSCANGHA-54 Rebranding by @antonioaversa in #152
SQSCANGHA-56 Support GitHub self-hosted runners without keytool by @antonioaversa in #149

Full Changelog: SonarSource/sonarqube-scan-action@v4.0.0...v4.1.0

`v4.1`

Compare Source

actions/checkout (actions/checkout)

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v7`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

`v6.0.2`

Compare Source

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in #2356

`v6.0.1`

Compare Source

Add worktree support for persist-credentials includeIf by @ericsciple in #2327

`v6.0.0`

Compare Source

Persist creds to a separate file by @ericsciple in #2286
Update README to include Node.js 24 support details and requirements by @salmanmkc in #2248

`v6`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

`v5.0.1`

Compare Source

Port v6 cleanup to v5 by @ericsciple in #2301

`v5.0.0`

Compare Source

Update actions checkout to use node 24 by @salmanmkc in #2226

`v5`

Compare Source

Port v6 cleanup to v5 by @ericsciple in #2301

`v4.3.1`

Compare Source

Port v6 cleanup to v4 by @ericsciple in #2305

`v4.3.0`

Compare Source

docs: update README.md by @motss in #1971
Add internal repos for checking out multiple repositories by @mouismail in #1977
Documentation update - add recommended permissions to Readme by @benwells in #2043
Adjust positioning of user email note and permissions heading by @joshmgross in #2044
Update README.md by @nebuk89 in #2194
Update CODEOWNERS for actions by @TingluoHuang in #2224
Update package dependencies by @salmanmkc in #2236

actions/dependency-review-action (actions/dependency-review-action)

`v5.0.0`: 5.0.0

Compare Source

This is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version v2.327.1 to run.

What's Changed

Add .github/copilot-instructions.md for Copilot coding agent by @ahpook in #1067
Update Node.js runtime from 20 to 24 by @scottschreckengaust in #1084
Bump spdx-license-ids from 3.0.20 to 3.0.23 by @mongolyy in #1091
docs: bump actions/checkout from v4 to v6 in workflow examples by @Marukome0743 in #1077
fix: patched version display for advisories with non-strict semver ranges (e.g. Maven beta versions) by @tspascoal in #1076
Resolve security findings by @AshelyTC in #1094
v5.0.0 release branch by @ahpook in #1098

New Contributors

@scottschreckengaust made their first contribution in #1084
@mongolyy made their first contribution in #1091
@Marukome0743 made their first contribution in #1077

Full Changelog: actions/dependency-review-action@v4.9.0...v5.0.0

`v4.9.0`: Dependency Review Action 4.9.0

Compare Source

This feature release contains a couple of notable changes:

There is a new configuration option show_patched_versions which will add a column to the output, showing the fix version of each vulnerable dependency. Thanks @felickz!
Runs which do not display OpenSSF scorecards no longer fetch scorecard information; previously it was fetched regardless of whether or not it was displayed, causing unneccessary slowness. Great catch @jantiebot!
There are a couple of fixes to purl parsing which should improve match accuracy for allow-package-dependency lists, including case (in)sensitivity and url-encoded namespaces Thanks @juxtin!

What's Changed

Compare normalized purls to account for encoding quirks by @juxtin in #1056
Make purl comparisons case insensitive by @juxtin in #1057
Feat: Add Patched Version to Vulnerabilities summary by @felickz in #1045
fix: only get scorecard levels if user wants to see the OpenSSF scorecard by @jantiebot in #1060
Bump actions/stale from 10.1.0 to 10.2.0 by @dependabot[bot] in #1058
Bump actions/checkout from 4 to 6 by @dependabot[bot] in #1021
Updates for release 4.9.0 by @ahpook in #1064

New Contributors

@jantiebot made their first contribution in #1060

Full Changelog: actions/dependency-review-action@v4.8.3...v4.9.0

`v4.8.3`: 4.8.3

Compare Source

Dependency Review Action v4.8.3

This is a bugfix release that updates a number of upstream dependencies and includes a fix for the earlier feature that detected oversized summaries and upload them as artifacts, which could occasionally crash the action.

We have also updated the release process to use a long-lived v4 branch for the action, instead of a force-pushed tag, which aligns better with git branching strategies; the change should be transparent to end users.

What's Changed

GitHub Actions can't push to our protected main by @dangoor in #1017
Bump actions/stale from 9.1.0 to 10.1.0 by @dependabot[bot] in #995
Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #1003
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #1005
Upgrade glob to address a vulnerability by @brrygrdn in #1024
Bump js-yaml by @dependabot[bot] in #1020
Addressing vulnerabilities by @Ahmed3lmallah in #1036
Bump fast-xml-parser from 5.3.3 to 5.3.5 by @dependabot[bot] in #1050
Bump fast-xml-parser from 5.3.5 to 5.3.6 by @dependabot[bot] in #1053
Properly truncate long summaries and catch errors by @juxtin in #1052
Bump spdx-expression-parse from 3.0.1 to 4.0.0 in the spdx-licenses group across 1 directory by @dependabot[bot] in #931
Changes for Release 4.8.3 by @ahpook in #1054

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.8.2..v4.8.3

`v4.8.2`

Compare Source

Minor fixes:

Fix PURL parsing for scoped packages (#1008 from @danielhardej)
Fix for large summaries (#1007 from @gitulisca)
README includes a working example for allow-dependencies-licenses (#1009 from @danielhardej)

`v4.8.1`: Dependency Review Action v4.8.1

Compare Source

What's Changed

(bug) Fix spamming link test in deprecation warning (again) by @ahpook in #1000
Bump version for 4.8.1 release by @ahpook in #1001

Full Changelog: actions/dependency-review-action@v4...v4.8.1

`v4.8.0`

Compare Source

What's Changed

Make Ruby Code Scannable by @ljones140 in #978
Batch some contributions for release by @brrygrdn in #986
- Make license lists collapsable by @jasperkamerling
- feat: add large summary handling with artifact upload by @MattMencel

New Contributors

@ljones140 made their first contribution in #978
@jasperkamerling made their first contribution in #986
@MattMencel made their first contribution in #986

Full Changelog: actions/dependency-review-action@v4...v4.8.0

`v4.7.4`

Compare Source

`v4.7.3`: 4.7.3

Compare Source

What's Changed

Add explicit permissions to workflow files by @AshelyTC in #966
Claire153/fix spamming mentioned issue by @claire153 in #974

Full Changelog: actions/dependency-review-action@v4...v4.7.3

`v4.7.2`: 4.7.2

Compare Source

What's Changed

Add Missing Languages to CodeQL Advanced Configuration by @KyFaSt in #945
Deprecate deny lists by @claire153 in #958
Address discrepancy between docs and reality by @ahpook in #960

New Contributors

@KyFaSt made their first contribution in #945
@claire153 made their first contribution in #958
@ahpook made their first contribution in #960

Full Changelog: actions/dependency-review-action@v4...v4.7.2

`v4.7.1`

Compare Source

Packages added to allow-dependencies-licenses will be allowed even if the package in question has no license information #889
License expressions (e.g. Ruby OR GPL-2.0) in the allow list are automatically discarded so that they don't invalidate the whole allow list, which should just be license identifier (e.g. Ruby)

`v4.7.0`

Compare Source

Handle complex license expressions (e.g. MIT AND GPL-2.0) in allow lists (fixes #809 and probably others)
Replace OTHER in package licenses with LicenseRef-clearlydefined-OTHER so that parsing passes

`v4.6.0`

Compare Source

What's Changed

Updating multiple dependency versions by @Ahmed3lmallah in #870
Grouping minor and patch dependabot updates to lessen the number of PRs by @Ahmed3lmallah in #876
Bump actions/stale from 9.0.0 to 9.1.0 by @dependabot in #878
Bump undici from 5.28.4 to 5.28.5 by @dependabot in #877
DR Action should link to the proxima stamp when appropriate in error messages by @AshelyTC in #891
Allow deny package removal by @ellenfieldn in #888
Fix typos by @omahs in #893
Bump esbuild from 0.19.5 to 0.25.0 by @dependabot in #900
Bump octokit and related dependencies by @RomanIakovlev in #904
Bump @babel/helpers from 7.23.2 to 7.26.10 by @dependabot in #905
Bump @octokit/plugin-paginate-rest from 9.1.5 to 9.2.2 by @dependabot in #899
Update transitive dependency spdx-license-ids by @ailox in #855
To not print OpenSSF Scorecard section if no dependencies scanned by @fabasoad in #884
Improve usage of this action in dependency-review.yml by @fabasoad in #883
Clarify comment-summary-in-pr behaviour by @Pantelis-Santorinios in #902
Prepare 4.6.0 Release candidate by @brrygrdn in #910

New Contributors

@AshelyTC made their first contribution in #891
@ellenfieldn made their first contribution in #888
@omahs made their first contribution in #893
@RomanIakovlev made their first contribution in #904
@ailox made their first contribution in #855
@fabasoad made their first contribution in #884
@Pantelis-Santorinios made their first contribution in #902
@brrygrdn made their first contribution in #910

Full Changelog: actions/dependency-review-action@v4.5.0...v4.6.0

actions/download-artifact (actions/download-artifact)

`v8.0.1`

Compare Source

What's Changed

Support for CJK characters in the artifact name by @danwkennedy in #471
Add a regression test for artifact name + content-type mismatches by @danwkennedy in #472

Full Changelog: actions/download-artifact@v8...v8.0.1

[`v8.0.0`](https://redirect.github.com/actions/download-artifact/releas

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- "after 10pm every weekday,before 5am every weekday,every weekend"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

coderabbitai · 2026-06-11T02:16:26Z

Warning

Review limit reached

@williaby, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 34 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: ecd1cae9-b7af-410f-aec3-8169ba3e6719

📥 Commits

Reviewing files that changed from the base of the PR and between 7c2c91e and e5298fc.

📒 Files selected for processing (6)

.github/workflows/dependency-review.yml
.github/workflows/fips-compatibility.yml
.github/workflows/pr-validation.yml
.github/workflows/reuse.yml
.github/workflows/slsa-provenance.yml
.github/workflows/sonarcloud.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch renovate/major-github-actions

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-06-11T02:16:56Z

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package

Version

Score

Details

actions/actions/download-artifact

3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c

🟢 5.1

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	⚠️ -1	packaging workflow not detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 9	security policy file detected
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches

actions/SonarSource/sonarqube-scan-action

713881670b6b3676cda39549040e2d88c70d582e

🟢 6.3

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Code-Review	🟢 9	Found 21/23 approved changesets -- score normalized to 9
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Maintained	🟢 10	23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	🟢 5	dependency not pinned by hash detected -- score normalized to 5
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 1	branch protection is not maximal on development and all release branches
SAST	🟢 6	SAST tool is not run on all commits -- score normalized to 6

actions/actions/checkout

9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0

🟢 6.9

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	16 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Packaging	⚠️ -1	packaging workflow not detected
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 9	security policy file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
SAST	🟢 10	SAST tool is run on all commits

actions/actions/setup-python

ece7cb06caefa5fff74198d8649806c4678c61a1

🟢 5.9

Details

Check	Score	Reason
Maintained	🟢 8	10 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 8
Code-Review	🟢 10	all changesets reviewed
Binary-Artifacts	🟢 10	no binaries found in the repo
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Packaging	⚠️ -1	packaging workflow not detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 9	security policy file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	🟢 9	SAST tool is not run on all commits -- score normalized to 9

actions/actions/upload-artifact

043fb46d1a93c77aae656e7c1c64a875d1fc6a0a

🟢 5.5

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Maintained	🟢 3	4 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
License	🟢 10	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 9	security policy file detected
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches

Scanned Files

.github/workflows/slsa-provenance.yml
.github/workflows/sonarcloud.yml

Copilot

Pull request overview

This PR updates pinned GitHub Actions used across the repository’s CI/security workflows to newer major versions, primarily to keep the automation ecosystem up to date (including Node.js runtime bumps in several actions).

Changes:

Bump core workflow actions (e.g., actions/checkout, actions/setup-python, actions/upload-artifact) to newer major versions pinned by commit SHA.
Update security/compliance-related actions (SonarSource/sonarqube-scan-action, actions/dependency-review-action, fsfe/reuse-action) to newer major versions.
Update utility actions used in validation/reporting (actions/download-artifact, actions/github-script, astral-sh/setup-uv, lycheeverse/lychee-action).

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/sonarcloud.yml	Updates checkout/setup-python/sonarqube scan/upload-artifact action pins used for SonarCloud analysis.
.github/workflows/slsa-provenance.yml	Updates `actions/download-artifact` pin used to fetch release artifacts for provenance hashing.
.github/workflows/reuse.yml	Updates checkout/reuse-action/upload-artifact pins for REUSE compliance checks and artifact upload.
.github/workflows/pr-validation.yml	Updates checkout/setup-python/setup-uv/lychee-action pins for PR validation jobs.
.github/workflows/fips-compatibility.yml	Updates checkout/setup-uv/upload-artifact/github-script pins used for FIPS scanning and PR commenting.
.github/workflows/dependency-review.yml	Updates checkout and dependency-review-action pins for PR dependency scanning.

      - name: Dependency Review
-        uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0


Copilot AI review requested due to automatic review settings June 11, 2026 02:16

williaby added breaking-change dependencies labels Jun 11, 2026

williaby self-assigned this Jun 11, 2026

Copilot started reviewing on behalf of williaby June 11, 2026 02:16 View session

Copilot AI reviewed Jun 11, 2026

View reviewed changes

Comment thread .github/workflows/dependency-review.yml

Comment on lines 37 to +38

- name: Dependency Review

uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0

uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

williaby force-pushed the renovate/major-github-actions branch from fede7ab to c26d58b Compare June 11, 2026 14:15

williaby force-pushed the renovate/major-github-actions branch 2 times, most recently from ff539c1 to 09f1559 Compare June 26, 2026 20:20

chore(deps)!: Update GitHub Actions

e5298fc

williaby force-pushed the renovate/major-github-actions branch from 09f1559 to e5298fc Compare June 29, 2026 18:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps)!: Update GitHub Actions (major)#37

chore(deps)!: Update GitHub Actions (major)#37
williaby wants to merge 1 commit into
mainfrom
renovate/major-github-actions

williaby commented Jun 11, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading

Review limit reached

Uh oh!

github-actions Bot commented Jun 11, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

williaby commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Changes

Impact

Acceptance Criteria

Testing

Notes

Release Notes

What's Changed

What's Changed

What's Changed

Breaking change

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

BREAKING CHANGE!

What's Changed

OVERLOOKED BREAKING CHANGE!

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

v5.0.0: 5.0.0

What's Changed

New Contributors

v4.9.0: Dependency Review Action 4.9.0

What's Changed

New Contributors

v4.8.3: 4.8.3

Dependency Review Action v4.8.3

What's Changed

v4.8.1: Dependency Review Action v4.8.1

What's Changed

What's Changed

New Contributors

v4.7.3: 4.7.3

What's Changed

v4.7.2: 4.7.2

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

[v8.0.0](https://redirect.github.com/actions/download-artifact/releas

Configuration

Uh oh!

coderabbitai Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

github-actions Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

williaby commented Jun 11, 2026 •

edited

Loading

`v5.0.0`: 5.0.0

`v4.9.0`: Dependency Review Action 4.9.0

`v4.8.3`: 4.8.3

`v4.8.1`: Dependency Review Action v4.8.1

`v4.7.3`: 4.7.3

`v4.7.2`: 4.7.2

[`v8.0.0`](https://redirect.github.com/actions/download-artifact/releas

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading

github-actions Bot commented Jun 11, 2026 •

edited

Loading