ci: bump the actions-updates group with 3 updates#219
Merged
tis24dev merged 1 commit intoMay 26, 2026
Conversation
Bumps the actions-updates group with 3 updates: [codecov/codecov-action](https://github.com/codecov/codecov-action), [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) and [github/codeql-action](https://github.com/github/codeql-action). Updates `codecov/codecov-action` from 6.0.0 to 6.0.1 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@57e3a13...e79a696) Updates `goreleaser/goreleaser-action` from 7.2.1 to 7.2.2 - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](goreleaser/goreleaser-action@1a80836...5daf1e9) Updates `github/codeql-action` from 4.35.5 to 4.36.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@9e0d7b8...7211b7c) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: goreleaser/goreleaser-action dependency-version: 7.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: github/codeql-action dependency-version: 4.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-updates ... Signed-off-by: dependabot[bot] <support@github.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
dependabot
Bot
deleted the
dependabot/github_actions/dev/actions-updates-d1f1034c07
branch
tis24dev
added a commit
that referenced
this pull request
May 26, 2026
* Bump x/crypto to v0.52.0 Fix GO-2026-5018 by updating golang.org/x/crypto and related checksums. * ci: download modules before govulncheck Ensure module checksums are fetched before vulnerability scanning. * Preserve legacy manifest parse causes Return both JSON and legacy parse errors from LoadManifest and cover the missing-archive metadata path in tests. * Align remote legacy manifest parsing Parse legacy targets and version fields in inspectRcloneMetadataManifest to match local manifest handling. * Propagate legacy scanner failures Return scanner errors from parseLegacyMetadata and fail fast when legacy metadata scanning is truncated. * Expand test coverage Add broader coverage for safeexec and staged/orchestrated restore flows. * Fix staged apply tests to use injectable root checks. Use accessControlApplyGeteuid and mountGuardGeteuid in maybeApply paths so CI tests can exercise error branches without real root, matching hooks used elsewhere in orchestrator. * test: expand PVE collector coverage * fix(backup): isolate PXAR per-datastore errors in parallel step Stop runPBSPXARStep from canceling sibling datastores on the first failure. Add isParentContextError and handlePBSPXARStepError so parent cancel/deadline propagates while datastore errors remain best-effort. Stabilizes race CI. * test: expand system collector probe and collection coverage Add branch and integration tests for systemctl, sensors, dmidecode, and related system collection paths in collector_system_test.go. * ci: bump the actions-updates group with 3 updates (#219) Bumps the actions-updates group with 3 updates: [codecov/codecov-action](https://github.com/codecov/codecov-action), [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) and [github/codeql-action](https://github.com/github/codeql-action). Updates `codecov/codecov-action` from 6.0.0 to 6.0.1 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@57e3a13...e79a696) Updates `goreleaser/goreleaser-action` from 7.2.1 to 7.2.2 - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](goreleaser/goreleaser-action@1a80836...5daf1e9) Updates `github/codeql-action` from 4.35.5 to 4.36.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@9e0d7b8...7211b7c) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: goreleaser/goreleaser-action dependency-version: 7.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: github/codeql-action dependency-version: 4.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-updates ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(backup): preserve JSON parse cause in LoadManifest error message json.Unmarshal was called with :=, shadowing the outer err variable. The combined error message reported JSON (<nil>) instead of the actual parse failure. Rename to unmarshalErr to capture and propagate it. Harden tests to assert both JSON and legacy causes in combined errors. * test(orchestrator): use unique per-run storage IDs in PVE mount guard tests Replace fixed /mnt/pve/<name> storage IDs (activate-ok, proxsave-offline, mkdir-fail, etc.) with unique per-run IDs using a proxsave-it-<hash>-<label> prefix. Add safety helpers that refuse RemoveAll/Remove on paths not owned by the test (no proxsave-it- prefix), preventing accidental collision with real PVE storage IDs on privileged hosts. Also add requireWritablePveMountRoot with a real write/remove probe and TestPveMountIntegrationTestPathSafety to guard the path-ownership logic. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions-updates group with 3 updates: codecov/codecov-action, goreleaser/goreleaser-action and github/codeql-action.
Updates
codecov/codecov-actionfrom 6.0.0 to 6.0.1Release notes
Sourced from codecov/codecov-action's releases.
Changelog
Sourced from codecov/codecov-action's changelog.
... (truncated)
Commits
e79a696chore(release): 6.0.1 (#1949)51e6422fix: prevent template injection in run: steps (VULN-1652) (#1947)Updates
goreleaser/goreleaser-actionfrom 7.2.1 to 7.2.2Release notes
Sourced from goreleaser/goreleaser-action's releases.
Commits
5daf1e9fix: nightly resolution to select newest published release (#562)5cc7ebbci: update actions702f5f9ci(deps): bump the actions group with 3 updates (#560)Updates
github/codeql-actionfrom 4.35.5 to 4.36.0Release notes
Sourced from github/codeql-action's releases.
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
7211b7cMerge pull request #3927 from github/update-v4.36.0-ebc2d9e2b7740f2fUpdate changelog for v4.36.0ebc2d9eMerge pull request #3926 from github/update-bundle/codeql-bundle-v2.25.5d1f74b7Add changelog note2dc40ceUpdate default bundle to codeql-bundle-v2.25.58449852Merge pull request #3910 from github/henrymercer/repo-size-diff-check72ac23cUpdate excluded required check listc5297a2Merge pull request #3919 from github/henrymercer/workflow-concurrency8ffeae7CI: Automatically cancel non-generated workflowsf3f52bfRevertgetErrorMessageimportDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsGreptile Summary
This is an automated Dependabot PR updating three GitHub Actions used across CI workflows. All action references remain SHA-pinned, which is the correct security posture.
codecov/codecov-actionbumped from v6.0.0 → v6.0.1: patches a template injection vulnerability (VULN-1652) inrun:steps — a welcome security fix.goreleaser/goreleaser-actionbumped from v7.2.1 → v7.2.2: minor patch for nightly release resolution; no breaking changes.github/codeql-actionbumped from 4.35.5 → 4.36.0: adds SHA-256 Git object ID support and updates the default CodeQL bundle to v2.25.5; breaking change bumps minimum required bundle to 2.19.4, which GitHub-hosted runners satisfy automatically.Confidence Score: 5/5
Safe to merge — all three updates are routine patch/minor bumps with SHA-pinned references and no changes to workflow logic.
All changes are Dependabot-generated SHA-pin updates. The codecov bump specifically closes a template injection security hole, making the merge beneficial. The codeql-action minor bump raises the minimum required bundle version, but GitHub-hosted runners already meet that requirement. No workflow logic, permissions, or secrets handling was modified.
No files require special attention.
Important Files Changed
Flowchart
%%{init: {'theme': 'neutral'}}%% flowchart TD A[Dependabot PR #219] --> B[codecov.yml] A --> C[release.yml] A --> D[security-ultimate.yml] B --> B1["codecov/codecov-action\nv6.0.0 → v6.0.1\n🔒 fixes VULN-1652 template injection"] C --> C1["goreleaser/goreleaser-action\nv7.2.1 → v7.2.2\npatch: nightly resolution fix"] D --> D1["github/codeql-action/upload-sarif\n4.35.5 → 4.36.0"] D --> D2["github/codeql-action/init\n4.35.5 → 4.36.0"] D --> D3["github/codeql-action/analyze\n4.35.5 → 4.36.0"] D1 & D2 & D3 --> E["Min CodeQL bundle: 2.19.4\nDefault bundle: v2.25.5\n✅ met by GitHub-hosted runners"]Reviews (1): Last reviewed commit: "ci: bump the actions-updates group with ..." | Re-trigger Greptile