Skip to content

chore(deps): update github-actions - workflows - .github/workflows/dependency-review.yml#1170

Merged
kriswest merged 1 commit intomainfrom
renovate/workflows-manager
Sep 8, 2025
Merged

chore(deps): update github-actions - workflows - .github/workflows/dependency-review.yml#1170
kriswest merged 1 commit intomainfrom
renovate/workflows-manager

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Aug 28, 2025

This PR contains the following updates:

Package Type Update Change
actions/dependency-review-action action digest da24556 -> 595b5ae
codecov/codecov-action action minor v5.4.3 -> v5.5.1
github/codeql-action action minor v3.29.9 -> v3.30.1
github/codeql-action action digest df55935 -> f1f6e5f

Release Notes

codecov/codecov-action (codecov/codecov-action)

v5.5.1

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

Compare Source

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

github/codeql-action (github/codeql-action)

v3.30.1

Compare Source

v3.30.0

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.30.0 - 01 Sep 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.29.11

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.11 - 21 Aug 2025
  • Update default CodeQL bundle version to 2.22.4. #​3044

See the full CHANGELOG.md for more information.

v3.29.10

Compare Source

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.10 - 18 Aug 2025

No user facing changes.

See the full CHANGELOG.md for more information.


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@netlify
Copy link

netlify bot commented Aug 28, 2025

Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Name Link
🔨 Latest commit abb972f
🔍 Latest deploy log https://app.netlify.com/projects/endearing-brigadeiros-63f9d0/deploys/68bae2586a375d0008cc80dd

@github-actions
Copy link

github-actions bot commented Aug 28, 2025

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
actions/codecov/codecov-action 5a1091511ad55cbe89839c7260b706298ca349f7 🟢 7.8
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 1013 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
License🟢 10license file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 10SAST tool is run on all commits
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 13 contributing companies or organizations
actions/github/codeql-action/analyze f1f6e5f6af878fb37288ce1c627459e94dbf7d01 UnknownUnknown
actions/github/codeql-action/autobuild f1f6e5f6af878fb37288ce1c627459e94dbf7d01 UnknownUnknown
actions/github/codeql-action/init f1f6e5f6af878fb37288ce1c627459e94dbf7d01 UnknownUnknown
actions/actions/dependency-review-action 595b5aeba73380359d98a5e087f648dbb0edce1b 🟢 7.9
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 9security policy file detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits
Vulnerabilities🟢 91 existing vulnerabilities detected
actions/github/codeql-action/upload-sarif f1f6e5f6af878fb37288ce1c627459e94dbf7d01 UnknownUnknown

Scanned Files

  • .github/workflows/ci.yml
  • .github/workflows/codeql.yml
  • .github/workflows/dependency-review.yml
  • .github/workflows/scorecard.yml

@codecov
Copy link

codecov bot commented Aug 28, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.22%. Comparing base (afbac09) to head (abb972f).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1170   +/-   ##
=======================================
  Coverage   83.22%   83.22%           
=======================================
  Files          66       66           
  Lines        2795     2795           
  Branches      332      332           
=======================================
  Hits         2326     2326           
  Misses        423      423           
  Partials       46       46           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate renovate bot force-pushed the renovate/workflows-manager branch 10 times, most recently from 5c2c091 to d6251ea Compare September 3, 2025 15:18
@renovate renovate bot force-pushed the renovate/workflows-manager branch 2 times, most recently from df8e09a to 74a68a2 Compare September 5, 2025 10:35
@renovate renovate bot force-pushed the renovate/workflows-manager branch from 74a68a2 to abb972f Compare September 5, 2025 13:15
@kriswest kriswest merged commit b5c0b2d into main Sep 8, 2025
16 checks passed
@renovate renovate bot deleted the renovate/workflows-manager branch September 8, 2025 10:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant