chore(deps): Update GitHub Actions

[williaby]

Summary

Why

Scheduled patch update, bug fixes and security patches with no API changes.

Changes

This PR contains the following updates:

Package	Change	Type	Update	Age	Adoption	Passing	Confidence	OpenSSF
ByronWilliamsCPA/.github (changelog)	987d517 → 1502ecd	action	digest
actions/attest-build-provenance	v4.1.0 → v4.1.1	action	patch
actions/setup-python	v6.2.0 → v6.3.0	action	minor

Impact

• ✅ Patch update: bug fixes and security patches only
• ✅ No breaking changes

Acceptance Criteria

• All CI checks pass

Testing

• CI gates pass (tests, lint, type checking, security scan)

Notes

---

Release Notes

actions/attest-build-provenance (actions/attest-build-provenance)

v4.1.1

Compare Source

[!NOTE]
As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

• Update actions/attest to v4.1.1 by @​bdehamer in #​858

Full Changelog: actions/attest-build-provenance@v4.1.0...v4.1.1

actions/setup-python (actions/setup-python)

v6.3.0

Compare Source

What's Changed

Enhancement

• Add RHEL support and include Linux distro in cache keys by @​priyagupta108 in #​1323
• Fix pip cache error handling on Windows by @​priyagupta108 in #​1040

Dependency update

• Upgrade minimatch from 3.1.2 to 3.1.5 by @​dependabot in #​1281
• Upgrade actions dependencies by @​gowridurgad with @​Copilot in #​1303
• Upgrade @​actions/cache to 5.1.0, log cache write denied by @​jasongin in #​1324
• Upgrade dependency versions and test workflow configuration by @​HarithaVattikuti in #​1322

Documentation

• Update advanced-usage.md by @​Dunky-Z in #​811

New Contributors

• @​gowridurgad with @​Copilot made their first contribution in #​1303
• @​jasongin made their first contribution in #​1324
• @​Dunky-Z made their first contribution in #​811

Full Changelog: actions/setup-python@v6...v6.3.0

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "after 10pm every weekday,before 5am every weekday,every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[coderabbitai]

Walkthrough

Thirteen CI workflow files each update one or more pinned commit SHAs: reusable org-level workflow references are bumped to 83cc3919ba606da9459a7e0fa7e2a121e1aae3d5, actions/setup-python is updated to v6.3.0, and actions/attest-build-provenance is updated to v4.1.1.

CI Workflow SHA Bumps

Layer / File(s)

Summary

Reusable workflow and action SHA bumps .github/workflows/codecov.yml, .github/workflows/codeql.yml, .github/workflows/coverage.yml, .github/workflows/docs.yml, .github/workflows/fips-compatibility.yml, .github/workflows/mutation-testing.yml, .github/workflows/pr-validation.yml, .github/workflows/python-compatibility.yml, .github/workflows/qlty.yml, .github/workflows/sbom.yml, .github/workflows/slsa-provenance.yml, .github/workflows/sonarcloud.yml

Pinned SHA references for org-level reusable workflows updated to 83cc391...; actions/setup-python bumped to v6.3.0; actions/attest-build-provenance bumped to v4.1.1.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related issues

• Dependency Dashboard .claude#60: Workflow SHA bumps in this PR directly match the dependency updates tracked in that Dependency Dashboard for the same GitHub workflow references.
• fix(ci): pin org reusable workflow references to SHA instead of @main audio-processor#9: Both involve pinning org workflow references to specific SHAs rather than floating on @main.

Possibly related PRs

• ByronWilliamsCPA/python-libs#13: Introduced the same reusable workflow uses: references that this PR is now re-pinning to newer SHAs.
• ByronWilliamsCPA/python-libs#34: Previously bumped overlapping action references in codeql.yml and slsa-provenance.yml.
• ByronWilliamsCPA/python-libs#44: Identical chore pattern — repinning the same set of reusable workflow SHAs across the same workflow files.

Suggested labels

ci

🐇 A hop, a skip, a SHA update so neat,
The workflows all march to a pinned new beat.
v6.3.0 for Python, provenance v4.1.1 too,
The reusable workflows gleam fresh and new.
Bunny stamps the CI with a satisfied paw! 🐾

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: updating GitHub Actions dependencies across workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch renovate/github-actions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR updates the pinned commit SHA references for several org-level reusable GitHub Actions workflows (ByronWilliamsCPA/.github) from 987d517… to 7198a49…, keeping CI/security automation aligned with the latest patch-level fixes.

Changes:

• Bumped the referenced digest for the shared python-* reusable workflows across CI-adjacent pipelines (SonarCloud, SLSA provenance, SBOM, coverage uploads, docs, compatibility, etc.).
• No workflow logic or inputs were changed in this repo—only the pinned workflow revision.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/sonarcloud.yml	Update reusable workflow pin for SonarCloud analysis.
.github/workflows/slsa-provenance.yml	Update reusable workflow pin for SLSA provenance generation.
.github/workflows/sbom.yml	Update reusable workflow pin for SBOM generation/security scan.
.github/workflows/qlty.yml	Update reusable workflow pin for Qlty coverage upload.
.github/workflows/python-compatibility.yml	Update reusable workflow pin for compatibility matrix runs.
.github/workflows/pr-validation.yml	Update reusable workflow pin for supplemental PR checks.
.github/workflows/mutation-testing.yml	Update reusable workflow pin for mutation testing.
.github/workflows/fips-compatibility.yml	Update reusable workflow pin for FIPS compatibility checks.
.github/workflows/docs.yml	Update reusable workflow pin for docs build/deploy.
.github/workflows/coverage.yml	Update reusable workflow pin for Qlty coverage upload (post-CI).
.github/workflows/codecov.yml	Update reusable workflow pin for Codecov coverage upload.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/mutation-testing.yml (1)

42-53: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Consider scoping secrets instead of secrets: inherit.

secrets: inherit (Line 53) forwards every repo/org secret to the called workflow rather than only what it needs. Since this is a same-org, SHA-pinned reusable workflow the blast radius is bounded, but passing explicit named secrets follows least-privilege and silences the zizmor secrets-inherit warning. As per path instructions, review workflows for proper secret handling.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/mutation-testing.yml around lines 42 - 53, The reusable
workflow call in mutation-testing.yml is using secrets: inherit, which passes
all available secrets instead of only the ones needed; update the workflow
invocation to pass explicit named secrets to the python-mutation.yml call and
remove the blanket inheritance, using the existing reusable-workflow
inputs/secrets mapping near the with block and secrets handling to keep
least-privilege and satisfy the secrets-inherit warning.

Sources: Path instructions, Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/mutation-testing.yml:
- Around line 42-53: The reusable workflow call in mutation-testing.yml is using
secrets: inherit, which passes all available secrets instead of only the ones
needed; update the workflow invocation to pass explicit named secrets to the
python-mutation.yml call and remove the blanket inheritance, using the existing
reusable-workflow inputs/secrets mapping near the with block and secrets
handling to keep least-privilege and satisfy the secrets-inherit warning.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1bd7a2bf-ed41-4059-9254-3d86cd3c09b6

📥 Commits

Reviewing files that changed from the base of the PR and between e3ea1fc and 7b7e5fc.

📒 Files selected for processing (12)

• .github/workflows/codecov.yml
• .github/workflows/codeql.yml
• .github/workflows/coverage.yml
• .github/workflows/docs.yml
• .github/workflows/fips-compatibility.yml
• .github/workflows/mutation-testing.yml
• .github/workflows/pr-validation.yml
• .github/workflows/python-compatibility.yml
• .github/workflows/qlty.yml
• .github/workflows/sbom.yml
• .github/workflows/slsa-provenance.yml
• .github/workflows/sonarcloud.yml

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud