Skip to content

chore(deps): update github-actions - workflows - .github/workflows/dependency-review.yml#1250

Merged
JamieSlome merged 1 commit intomainfrom
renovate/workflows-manager
Oct 20, 2025
Merged

chore(deps): update github-actions - workflows - .github/workflows/dependency-review.yml#1250
JamieSlome merged 1 commit intomainfrom
renovate/workflows-manager

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Oct 15, 2025

This PR contains the following updates:

Package Type Update Change
actions/dependency-review-action action digest 56339e5 -> 4552948
github/codeql-action action patch v3.30.5 -> v3.30.9
github/codeql-action action digest 3599b3b -> 4221315
ossf/scorecard-action action patch v2.4.2 -> v2.4.3

Release Notes

github/codeql-action (github/codeql-action)

v3.30.9

Compare Source

v3.30.8

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.8 - 10 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.30.7

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.7 - 06 Oct 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.30.6

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.6 - 02 Oct 2025
  • Update default CodeQL bundle version to 2.23.2. #​3168

See the full CHANGELOG.md for more information.

ossf/scorecard-action (ossf/scorecard-action)

v2.4.3

Compare Source

What's Changed

This update bumps the Scorecard version to the v5.3.0 release. For a complete list of changes, please refer to the Scorecard v5.3.0 release notes.

Documentation

Other

New Contributors

Full Changelog: ossf/scorecard-action@v2.4.2...v2.4.3


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@netlify
Copy link
Copy Markdown

netlify Bot commented Oct 15, 2025

Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Name Link
🔨 Latest commit aa62057
🔍 Latest deploy log https://app.netlify.com/projects/endearing-brigadeiros-63f9d0/deploys/68f2f78360a0a00008e2456d

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Oct 15, 2025

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
actions/github/codeql-action/analyze 42213152a85ae7569bdb6bec7bcd74cd691bfe41 UnknownUnknown
actions/github/codeql-action/autobuild 42213152a85ae7569bdb6bec7bcd74cd691bfe41 UnknownUnknown
actions/github/codeql-action/init 42213152a85ae7569bdb6bec7bcd74cd691bfe41 UnknownUnknown
actions/actions/dependency-review-action 45529485b5eb76184ced07362d2331fd9d26f03f 🟢 7.7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 9security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
License🟢 10license file detected
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
Vulnerabilities🟢 64 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
actions/github/codeql-action/upload-sarif 42213152a85ae7569bdb6bec7bcd74cd691bfe41 UnknownUnknown
actions/ossf/scorecard-action 4eaacf0543bb3f2c246792bd56e8cdeffafb205a 🟢 9.1
Details
CheckScoreReason
Dependency-Update-Tool🟢 10update tool detected
Security-Policy🟢 10security policy file detected
Maintained🟢 1017 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review🟢 10all changesets reviewed
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
License🟢 10license file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 16 contributing companies or organizations

Scanned Files

  • .github/workflows/codeql.yml
  • .github/workflows/dependency-review.yml
  • .github/workflows/scorecard.yml

@codecov
Copy link
Copy Markdown

codecov Bot commented Oct 15, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.40%. Comparing base (6ea37c1) to head (aa62057).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1250   +/-   ##
=======================================
  Coverage   83.40%   83.40%           
=======================================
  Files          70       70           
  Lines        3007     3007           
  Branches      501      501           
=======================================
  Hits         2508     2508           
  Misses        396      396           
  Partials      103      103           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate renovate Bot force-pushed the renovate/workflows-manager branch 2 times, most recently from 1480331 to bd2f30f Compare October 17, 2025 16:08
@renovate renovate Bot force-pushed the renovate/workflows-manager branch from bd2f30f to aa62057 Compare October 18, 2025 02:12
Copy link
Copy Markdown
Member

@JamieSlome JamieSlome left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@JamieSlome JamieSlome merged commit 375bd13 into main Oct 20, 2025
16 checks passed
@JamieSlome JamieSlome deleted the renovate/workflows-manager branch October 20, 2025 20:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant