Skip to content

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Sep 25, 2025

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.

This PR contains the following updates:

Package Type Update Change
actions/dependency-review-action action digest 595b5ae -> 56339e5
github/codeql-action action patch v3.30.3 -> v3.30.5
github/codeql-action action digest 192325c -> 3599b3b

Release Notes

github/codeql-action (github/codeql-action)

v3.30.5

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.5 - 26 Sep 2025

  • We fixed a bug that was introduced in 3.30.4 with upload-sarif which resulted in files without a .sarif extension not getting uploaded. #​3160

See the full CHANGELOG.md for more information.

v3.30.4

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.4 - 25 Sep 2025

  • We have improved the CodeQL Action's ability to validate that the workflow it is used in does not use different versions of the CodeQL Action for different workflow steps. Mixing different versions of the CodeQL Action in the same workflow is unsupported and can lead to unpredictable results. A warning will now be emitted from the codeql-action/init step if different versions of the CodeQL Action are detected in the workflow file. Additionally, an error will now be thrown by the other CodeQL Action steps if they load a configuration file that was generated by a different version of the codeql-action/init step. #​3099 and #​3100
  • We added support for reducing the size of dependency caches for Java analyses, which will reduce cache usage and speed up workflows. This will be enabled automatically at a later time. #​3107
  • You can now run the latest CodeQL nightly bundle by passing tools: nightly to the init action. In general, the nightly bundle is unstable and we only recommend running it when directed by GitHub staff. #​3130
  • Update default CodeQL bundle version to 2.23.1. #​3118

See the full CHANGELOG.md for more information.


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Copy link

netlify bot commented Sep 25, 2025

Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Name Link
🔨 Latest commit 8ede52d
🔍 Latest deploy log https://app.netlify.com/projects/endearing-brigadeiros-63f9d0/deploys/68dbb31678e0c700083e749b

Copy link

github-actions bot commented Sep 25, 2025

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
actions/github/codeql-action/analyze 3599b3baa15b485a2e49ef411a7a4bb2452e7f93 UnknownUnknown
actions/github/codeql-action/autobuild 3599b3baa15b485a2e49ef411a7a4bb2452e7f93 UnknownUnknown
actions/github/codeql-action/init 3599b3baa15b485a2e49ef411a7a4bb2452e7f93 UnknownUnknown
actions/actions/dependency-review-action 56339e523c0409420f6c2c9a2f4292bbb3c07dd3 🟢 7.9
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 9security policy file detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits
Vulnerabilities🟢 91 existing vulnerabilities detected
actions/github/codeql-action/upload-sarif 3599b3baa15b485a2e49ef411a7a4bb2452e7f93 UnknownUnknown

Scanned Files

  • .github/workflows/codeql.yml
  • .github/workflows/dependency-review.yml
  • .github/workflows/scorecard.yml

Copy link

codecov bot commented Sep 25, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.20%. Comparing base (0e16394) to head (8ede52d).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1226   +/-   ##
=======================================
  Coverage   84.20%   84.20%           
=======================================
  Files          68       68           
  Lines        2938     2938           
  Branches      374      374           
=======================================
  Hits         2474     2474           
  Misses        404      404           
  Partials       60       60           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate renovate bot changed the title chore(deps): update github-actions - workflows - .github/workflows/scorecard.yml chore(deps): update github-actions - workflows - .github/workflows/dependency-review.yml Sep 26, 2025
@renovate renovate bot force-pushed the renovate/workflows-manager branch 4 times, most recently from 7bfcca3 to 4ec53e3 Compare September 30, 2025 08:52
@renovate renovate bot force-pushed the renovate/workflows-manager branch from 4ec53e3 to 8ede52d Compare September 30, 2025 10:38
@kriswest kriswest merged commit 86f2572 into main Sep 30, 2025
14 checks passed
@renovate renovate bot deleted the renovate/workflows-manager branch September 30, 2025 10:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant