Update github actions (main) by red-hat-konflux[bot] · Pull Request #3627 · conforma/cli

red-hat-konflux · 2026-10-15T01:47:02Z

This PR contains the following updates:

Package	Type	Update	Change
conforma/github-workflows (changelog)	action	digest	`837d70f` → `ff1126b`
conforma/github-workflows (changelog)	workflow	digest	`837d70f` → `ff1126b`
ossf/scorecard-action	action	minor	`v2.4.4` → `v2.5.0`
step-security/harden-runner	action	minor	`v2.21.1` → `v2.22.1`

Release Notes

ossf/scorecard-action (ossf/scorecard-action)

`v2.5.0`

Compare Source

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.

The action's container image is built with Go 1.27.2 on a refreshed distroless base. by
@justaugustus in #1716
The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still
recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @justaugustus in #1716
The Scorecard version in results now always matches the Scorecard release the action is built
with. by @justaugustus in #1718
The action no longer prints the GitHub token variable while validating its options. by
@arpitjain099 in #1709
results_format accepts intoto, which wraps the JSON results in an in-toto attestation
statement. by @puerco in #1702

Other

Add a daily canary against Scorecard main by @justaugustus in #1711
Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by @justaugustus in #1714
Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update
RELEASE.md by @justaugustus in #1716
Bump Scorecard to v5.6.0 by @justaugustus in #1719

New Contributors

@arpitjain099 made their first contribution in #1709
@puerco made their first contribution in #1702

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

step-security/harden-runner (step-security/harden-runner)

`v2.22.1`

Compare Source

What's Changed

Fixed security rules not initializing on GHES self-hosted runners
Fixed GHES connectivity in block mode by implicitly allowing the GHES hostname

Full Changelog: step-security/harden-runner@v2.22.0...v2.22.1

`v2.22.0`

Compare Source

What's Changed

Linux ARM64 support for community tier
GHES support for self-hosted VMs (enterprise tier)
MacOS and Windows runner deny list support for block policy (enterprise tier).

Full Changelog: step-security/harden-runner@v2.21.1...v2.22.0

Configuration

📅 Schedule: (UTC)

Branch creation
- Between 12:00 AM and 03:59 AM (* 0-3 * * *)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

coderabbitai · 2026-10-15T01:47:35Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: e86d251b-f31f-4370-aa44-7b27ebc8143d

📥 Commits

Reviewing files that changed from the base of the PR and between 0c18175 and 292faaa.

📒 Files selected for processing: 1

.github/workflows/scorecard.yml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

📝 Walkthrough

Workflow files update pinned action references. Eight workflows use updated action pins, and the auto-merge reusable workflow and Go version check action use new commit references.

Changes: Workflow action reference updates

Layer / File(s)	Summary
Update workflow action pins `.github/workflows/benchmark.yaml`, `.github/workflows/checks-codecov.yaml`, `.github/workflows/codeql.yaml`, `.github/workflows/lint.yaml`, `.github/workflows/release.yaml`, `.github/workflows/scorecard.yml`, `.github/workflows/website.yaml`	Seven workflows update Harden Runner to v2.22.1. The Scorecard workflow also updates `ossf/scorecard-action` to v2.5.0.
Update other action references `.github/workflows/auto-merge.yaml`, `.github/workflows/checks-codecov.yaml`	The auto-merge job and Go version check action use new commit references.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: dheerajodha, simonbaird

Merge Risk: ⚪ Minimal · up to 292fa

The updated workflow references preserve their existing invocation contracts; no actionable merge risk remains from these changes.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly summarizes the GitHub Actions dependency updates.
Description check		The description explains the updates and includes relevant release context. The optional Tickets section is not populated, but the description is mostly complete.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

fullsend-ai-review · 2026-10-15T01:57:58Z

Risk Assessment: moderate (2/5)

Details

Routine Renovate bot PR updating GitHub Actions versions across 8 CI workflow files. Tier 1 signals unchanged from prior assessment (2/5 moderate): elevated PROTECTED_PATH_COUNT and CI_WORKFLOW_CHANGED are structural to any CI workflow PR, offset by bot authorship, zero security-sensitive files, and XS line count. Tier 2 regression-history score driven by EC-1818 benchmark feature iterations, not post-ship breakage. Composite 2.30 rounds to 2.

Previous run

Risk Assessment: moderate (2/5)

Details

Routine Renovate bot PR updating GitHub Actions versions across 8 CI workflow files; bot authorship, zero security-sensitive files, and low recent churn offset the elevated protected-path count and CI_WORKFLOW_CHANGED flag, yielding a moderate composite of 2.

fullsend-ai-review · 2026-10-15T01:58:00Z

Automated Renovate dependency bump: pinned action SHA/version updates for step-security/harden-runner (v2.21.1 → v2.22.1), ossf/scorecard-action (v2.4.4 → v2.5.0), and conforma/github-workflows digest (837d70f → ff1126b) across eight .github/workflows/ files. No code-level findings surfaced at or above the configured severity threshold. Protected-path (.github/) changes still require human approval regardless of this verdict.

Previous run

Review

Findings

High

[protected-path] .github/workflows/ (8 files) — This PR modifies files under .github/workflows/, a protected path requiring human approval. The PR has no linked issue; authorization is implicit via Renovate automation and the repository's renovate.json (which extends conforma/.github//config/renovate/renovate.json). Affected files: auto-merge.yaml, benchmark.yaml, checks-codecov.yaml, codeql.yaml, lint.yaml, release.yaml, scorecard.yml, website.yaml.
Remediation: Human reviewer should confirm the digest bumps are intended. Orchestrator-verified: new step-security/harden-runner digest ccd8616d44fd3846e67624a50d5aad6d37bf2d25 resolves to tag v2.22.1; conforma/github-workflows SHA ff1126bc5d04b54ea020efef3c699e53872f2de8 exists on main (identical, ahead_by=0, behind_by=0). SHA-pinning conventions are preserved on all third-party references.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

codecov · 2026-10-15T01:58:48Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	`54.54% <ø> (ø)`
generative	`12.25% <ø> (ø)`
integration	`23.55% <ø> (ø)`
unit	`72.26% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

Superseded by updated review

red-hat-konflux Bot requested a review from a team as a code owner October 15, 2026 01:47

red-hat-konflux Bot added main renovate labels Oct 15, 2026

red-hat-konflux Bot enabled auto-merge October 15, 2026 01:47

github-actions Bot added the size: XS label Oct 15, 2026

fullsend-ai-review Bot added the risk/moderate PR risk: moderate label Oct 15, 2026

This comment was marked as outdated.

Sign in to view

Update github actions

292faaa

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/github-actions branch from 0c18175 to 292faaa Compare October 17, 2026 03:14

fullsend-ai-review Bot added the requires-manual-review Review requires human judgment label Oct 17, 2026

Navigation Menu

Repository navigation

Update github actions (main) - #3627

Update github actions (main)#3627
red-hat-konflux[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main-main/github-actions

red-hat-konflux Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

fullsend-ai-review Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

fullsend-ai-review Bot commented Oct 15, 2026 •

edited

Loading

Review

Findings

High

Uh oh!

This comment was marked as outdated.

Uh oh!

codecov Bot commented Oct 15, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

red-hat-konflux Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.5.0

What's Changed

Other

New Contributors

v2.22.1

What's Changed

v2.22.0

What's Changed

Configuration

Documentation

Uh oh!

coderabbitai Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review

Findings

High

Uh oh!

This comment was marked as outdated.

Uh oh!

codecov Bot commented Oct 15, 2026

Codecov Report

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

red-hat-konflux Bot commented Oct 15, 2026 •

edited

Loading

`v2.5.0`

`v2.22.1`

`v2.22.0`

coderabbitai Bot commented Oct 15, 2026 •

edited

Loading

fullsend-ai-review Bot commented Oct 15, 2026 •

edited

Loading

fullsend-ai-review Bot commented Oct 15, 2026 •

edited

Loading