[MRegra]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action (changelog)	action	digest	9b32540 → 33d7b85
renovatebot/github-action	action	patch	v46.3.10 → v46.3.12

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

renovatebot/github-action

v46.3.12

Compare Source

Documentation

• update references to renovatebot/github-action to v46.3.11 (2d01910)

Miscellaneous Chores

• deps: update dependency @​containerbase/oxlint-plugin to v1.1.0 (8e810d3)
• deps: update pnpm to v10.34.8 (021fa2a)
• deps: update pnpm to v10.34.9 (f7cbc90)

Build System

• deps: lock file maintenance (6eccec3)

Continuous Integration

• deps: update ghcr.io/renovatebot/renovate docker tag to v44.198.3 (7b49be6)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.199.0 (704d70b)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.199.2 (6536601)

v46.3.11

Compare Source

Bug Fixes

• throw when 'docker run' fails (#​1088) (1e94228)

Documentation

• update references to renovatebot/github-action to v46.3.10 (d435328)

Miscellaneous Chores

• deps: update dependency npm-run-all2 to v9.0.4 (0d94545)
• deps: update dependency typescript-eslint to v8.72.0 (3372a91)
• deps: update node.js to v24.22.2 (c5155d6)
• replace eslint and prettier with oxlint and oxfmt (#​1089) (5b781a4)

Continuous Integration

• deps: update ghcr.io/renovatebot/renovate docker tag to v44.181.11 (aa5e565)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.182.2 (3b94e1a)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.184.1 (71fd7a5)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.186.6 (7713216)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.186.7 (eedc0c9)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.188.2 (0d6adaa)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.188.4 (e46333c)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.190.0 (2309c61)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.190.1 (d4d64e2)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.190.2 (9b215f4)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.192.2 (63e8d32)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.195.1 (74bb3e0)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.196.0 (eeca60a)
• deps: update ghcr.io/renovatebot/renovate docker tag to v44.198.0 (fd40403)

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[MRegra]

fleet review

reviewer: PASS

Routine Renovate PR bumping SHA-pinned GitHub Actions (renovatebot/github-action v46.3.10→v46.3.12; codeql-action init/analyze to a new synced v4 digest). Minimal, scoped to .github/workflows, no app/runtime impact, no secrets touched. All 5 CI checks on the PR itself pass (build, CodeQL init+analyze, secrets, renovate/stability-days), so the change is validated in CI rather than needing a unit test. No root-cause concerns beyond "keep actions current," which this satisfies.

attempted

• git diff origin/main...HEAD
• gh pr checks 15 -R MRegra/fidus

adversary: PASS

This Renovate-authored PR only bumps action digests in two workflow files. I found nothing to block on. renovatebot/github-action goes from v46.3.10 to v46.3.12, and github/codeql-action/init and /analyze move to a new commit on the v4 line. Every uses: in .github/workflows/ is still pinned to a full 40-char commit SHA, and no mutable tags were added. Both CodeQL steps were bumped together, so init and analyze stay on the same version. Nothing else changed: permissions are still contents: read, the token gating, the secrets handling and the triggers are the same. The PR touches no application code, so there is no deploy, migration or runtime effect. Reverting the merge is safe because it only restores the previous digests. One check is left open (see the nit): this sandbox has no network, so I could not confirm upstream that the new SHAs are the real tag commits and not fork-only ones. CI running the security workflow with the new digest settles it for CodeQL. The Renovate action only runs on schedule or manual dispatch.

• nit Upstream SHA provenance not independently verified (no network in adversary sandbox) (.github/workflows/renovate.yml)
  I could not confirm upstream that renovatebot/github-action@1c0cf989… is the v46.3.12 tag and that github/codeql-action@33d7b85d… is a v4.x release commit rather than a fork-only commit. The commit is authored by Renovate renovate@whitesourcesoftware.com, which resolves digests from upstream tags. That makes provenance very likely, but I have not demonstrated it. The CodeQL digest is proven once the security.yml job resolves it in CI. The renovate.yml digest is only exercised on schedule or workflow_dispatch, so the reviewer or harness may want a manual dispatch or a tag-to-SHA check before relying on it.
  proof

`git ls-remote --tags https://github.com/renovatebot/github-action v46.3.12` → denied (no network); a WebFetch of the commit pages → denied. `git log origin/main..HEAD` → 081225381f80 Renovate <renovate@whitesourcesoftware.com> chore(deps): update github-actions non-major

attempted

• git diff --stat origin/main...HEAD: only renovate.yml (1 line) and security.yml (2 lines) changed; no code, manifests or tests
• Grepped every uses: under .github/: all 9 references are pinned to a full 40-char SHA with a version comment, and the diff adds no mutable-tag pins
• Checked init and analyze use the same codeql-action SHA (33d7b85d…), so the two steps stay on the same version
• Checked the changes don't widen authz or secret handling: renovate.yml still has permissions: contents: read, the same RENOVATE_TOKEN gating step and the same env; security.yml steps are unchanged apart from the digest
• Checked the v46.3.10→v46.3.12 patch bump keeps the same action inputs (only token is used); a patch release shouldn't add required inputs
• Commit author is the Renovate bot, which matches a digest-resolution update
• Rollback: reverting the merge only restores the previous digests and is stateless and safe
• Deploy-time: no runtime artifact changes, so there is no probe, image or migration impact
• Tried actionlint: not installed. Tried git ls-remote and web fetch to confirm upstream SHAs: both denied because the sandbox has no network

security: PASS

This is a three-line Renovate digest bump. The renovatebot/github-action pin moves from 2804199 (v46.3.10) to 1c0cf98 (v46.3.12), and both github/codeql-action init and analyze move from 9b32540 to 33d7b85 on the floating v4 tag. Every action is still pinned to a full 40-character SHA, and init and analyze stay on the same SHA.

Nothing else changed. Permissions are the same (renovate.yml still has top-level contents: read, and the codeql job still has security-events: write plus contents: read). The triggers are the same and there is no pull_request_target. Secret handling is the same: RENOVATE_TOKEN only goes to the action's token: input, behind the presence check. No test, gate or scanner was removed or weakened.

The commit's author is Renovate. All PR checks passed, including the Security/codeql job, which ran the new codeql-action SHA. The renovate/stability-days status (minimum release age) also passed.

I could not independently check that the new SHAs belong to the upstream repos and match the tags. The tools for that were denied in this session (gh api, git ls-remote and WebFetch). This matters because GitHub also resolves commits that exist only in a fork of the action repo. Given that Renovate produced both SHAs from upstream tags in a scoped update, the risk is low and does not justify blocking. A human can confirm with one command per SHA: gh api repos/renovatebot/github-action/commits/1c0cf989c02653fba0efe7ca5772338860ca71dc and gh api repos/github/codeql-action/commits/33d7b85da1a04171e211befe2c739303b9a4c066.

I found nothing exploitable.

• nit Pre-existing: security.yml has no top-level permissions block, so the secrets job runs with the repo's default GITHUB_TOKEN permissions (.github/workflows/security.yml)
  This is not introduced by this PR. The secrets (gitleaks) job does not declare permissions:, and the workflow has no top-level block either. That job therefore gets whatever default token permissions the repository is set to, which can be write-all on older repos. For least privilege, add a top-level permissions: contents: read (gitleaks on pull_request may also need pull-requests: read). The codeql job already narrows its own permissions. This is a follow-up and does not block this PR.
  proof

security.yml lines 1-8 have no `permissions:` key. Lines 26-34 (job `secrets`) have no `permissions:` key either. Only job `codeql` (lines 11-13) declares one.

attempted

• git diff origin/main...HEAD: 2 files, 3 lines, SHA pins only
• Read renovate.yml and security.yml in full: permissions, triggers and secret flow unchanged, no pull_request_target
• git log: the head commit's author is Renovate renovate@whitesourcesoftware.com, and renovate.json limits it to the maven and github-actions managers
• gh pr view 15: CI build, Security/codeql (running the new codeql-action SHA), secrets/gitleaks, CodeQL and renovate/stability-days all SUCCESS
• Tried to check upstream SHA provenance and tag mapping with gh api, git ls-remote and WebFetch: all three were denied in this session

Approvals: 3/3 on 0812253

🤖 Generated with Claude Code