build(deps): bump the github-actions group across 1 directory with 3 updates - #369
Merged
twitchyliquid64 merged 1 commit intoJun 15, 2026
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThis PR upgrades artifact upload/download actions in the macOS CI workflow (upload -> actions/upload-artifact@v7, download -> actions/download-artifact@v8) and updates the promote workflow to use actions/create-github-app-token@v3 for minting the docs-repo token. ChangesGitHub Actions Version Upgrades
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/promote.yml (1)
253-258: ⚡ Quick winExplicitly downscope the GitHub App token permissions.
actions/create-github-app-token@v3inherits all installation permissions unlesspermission-*inputs are set. This step only needs to dispatch togominimal/docs, so explicitly setting the minimum scope avoids accidental over-privilege if App permissions expand later.🔐 Proposed change
- name: Mint docs-repo token (gominimal-aw-bot) id: docs-token if: ${{ inputs.dry_run != true }} uses: actions/create-github-app-token@v3 with: app-id: ${{ vars.AW_BOT_APP_ID }} private-key: ${{ secrets.AW_BOT_PRIVATE_KEY }} owner: gominimal repositories: docs + permission-contents: writePlease verify the App installation has
contents: writeand no extra permission is required forPOST /repos/{owner}/{repo}/dispatches.
Reference: https://github.com/actions/create-github-app-token, https://docs.github.com/en/rest/repos/repos#create-a-repository-dispatch-event🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/promote.yml around lines 253 - 258, The GitHub App token step using actions/create-github-app-token@v3 is currently inheriting all installation permissions; explicitly downscope it by adding permission-* inputs to only what’s needed for the repository_dispatch call (e.g., add inputs like permission-contents: write and set unrelated permissions to none) alongside the existing app-id, private-key, owner, repositories inputs in the step; also verify the App installation grants contents: write so the POST /repos/{owner}/{repo}/dispatches will succeed and avoid granting broader permissions.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/promote.yml:
- Around line 253-258: The GitHub App token step using
actions/create-github-app-token@v3 is currently inheriting all installation
permissions; explicitly downscope it by adding permission-* inputs to only
what’s needed for the repository_dispatch call (e.g., add inputs like
permission-contents: write and set unrelated permissions to none) alongside the
existing app-id, private-key, owner, repositories inputs in the step; also
verify the App installation grants contents: write so the POST
/repos/{owner}/{repo}/dispatches will succeed and avoid granting broader
permissions.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 7e1bdbb2-cc73-4be8-877a-42300e525921
📒 Files selected for processing (2)
.github/workflows/ci-macos.yml.github/workflows/promote.yml
dependabot
Bot
force-pushed
the
dependabot/github_actions/github-actions-1d4fa2a04a
branch
3 times, most recently
from
June 11, 2026 15:55
3ae1280 to
9f3a44d
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/promote.yml (1)
253-258: Confirm v3 input compatibility for create-github-app-token
actions/create-github-app-token@v3still supportsprivate-key,owner, andrepositories.app-idis a legacy/backward-compatible input in v3; v3 docs recommend switching toclient-idinstead for future-proofing.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/promote.yml around lines 253 - 258, Replace the legacy app-id input with the v3-preferred client-id in the create-github-app-token step: update the input key from app-id: ${{ vars.AW_BOT_APP_ID }} to client-id: ${{ vars.AW_BOT_CLIENT_ID }} (or add a new vars entry if needed), while keeping private-key, owner and repositories inputs the same; you may keep app-id temporarily for backward compatibility but prefer client-id in the create-github-app-token@v3 step to future-proof the workflow.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/promote.yml:
- Around line 253-258: Replace the legacy app-id input with the v3-preferred
client-id in the create-github-app-token step: update the input key from app-id:
${{ vars.AW_BOT_APP_ID }} to client-id: ${{ vars.AW_BOT_CLIENT_ID }} (or add a
new vars entry if needed), while keeping private-key, owner and repositories
inputs the same; you may keep app-id temporarily for backward compatibility but
prefer client-id in the create-github-app-token@v3 step to future-proof the
workflow.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: bd4e9749-5c2a-41cd-823a-e003e34fa61b
📒 Files selected for processing (2)
.github/workflows/ci-macos.yml.github/workflows/promote.yml
dependabot
Bot
force-pushed
the
dependabot/github_actions/github-actions-1d4fa2a04a
branch
from
June 12, 2026 17:53
9f3a44d to
1a02e9d
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/promote.yml (1)
254-258:⚠️ Potential issue | 🟠 MajorNarrow the minted GitHub App token permissions for the repository dispatch step.
actions/create-github-app-token@v3doesn’t set anypermission-*inputs, so the minted token can inherit the app installation’s broader permissions (even though it’s scoped torepositories: docs). Restrict it with explicit least-privilege permissions needed forrepository_dispatch.Suggested hardening
- name: Mint docs-repo token (gominimal-aw-bot) id: docs-token if: ${{ inputs.dry_run != true }} uses: actions/create-github-app-token@v3 with: app-id: ${{ vars.AW_BOT_APP_ID }} private-key: ${{ secrets.AW_BOT_PRIVATE_KEY }} owner: gominimal repositories: docs + permission-contents: write🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/promote.yml around lines 254 - 258, The token minted by actions/create-github-app-token@v3 needs explicit least-privilege permission inputs: update the step that currently passes app-id/private-key/owner/repositories and add explicit permission-* inputs to restrict scopes (e.g. permission-repositories: 'write' and permission-actions: 'read' or 'write' as required for your repository_dispatch usage) so the created token cannot inherit broader installation permissions; modify the step that references actions/create-github-app-token@v3 to include these permission- inputs alongside app-id, private-key, owner and repositories.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci-macos.yml:
- Line 89: Replace mutable GitHub Action version tags with immutable commit
SHAs/digests: locate the `uses:` declarations `actions/upload-artifact@v7` and
`actions/create-github-app-token@v3` and change them to the corresponding pinned
references (owner/repo@sha or owner/repo@digest) found on the action's
marketplace or GitHub repo (use the latest stable commit SHA or the action's
provided digest). Ensure you update both occurrences and verify the workflow
still runs by testing the workflow or dry-running a workflow dispatch after
pinning.
---
Outside diff comments:
In @.github/workflows/promote.yml:
- Around line 254-258: The token minted by actions/create-github-app-token@v3
needs explicit least-privilege permission inputs: update the step that currently
passes app-id/private-key/owner/repositories and add explicit permission-*
inputs to restrict scopes (e.g. permission-repositories: 'write' and
permission-actions: 'read' or 'write' as required for your repository_dispatch
usage) so the created token cannot inherit broader installation permissions;
modify the step that references actions/create-github-app-token@v3 to include
these permission- inputs alongside app-id, private-key, owner and repositories.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 5ff5f45b-2bfd-4ca2-a2c8-6207ea11e134
📒 Files selected for processing (2)
.github/workflows/ci-macos.yml.github/workflows/promote.yml
| run: ./scripts/build-initramfs.sh "$RUNNER_TEMP/initramfs.cpio" | ||
| - name: Upload kernel artifact | ||
| uses: actions/upload-artifact@v4 | ||
| uses: actions/upload-artifact@v7 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
files=(".github/workflows/ci-macos.yml" ".github/workflows/promote.yml")
for f in "${files[@]}"; do
echo "---- $f ----"
if [ ! -f "$f" ]; then
echo "MISSING: $f"
continue
fi
echo "[uses: entries for actions/*]"
rg -n --no-heading "uses:\s*actions/" "$f" || true
echo
echo "[excerpt around line 89 in ci-macos.yml]"
if [ "$f" == ".github/workflows/ci-macos.yml" ]; then
sed -n '70,110p' "$f" | cat -n
fi
done
echo
echo "[Check pin format: count uses with @<40-hex> vs `@v`*]"
for f in "${files[@]}"; do
if [ ! -f "$f" ]; then
continue
fi
pinned_sha=$(rg -c "uses:\s*actions/[^@]+@[0-9a-f]{40}" "$f" || true)
pinned_digest=$(rg -c "uses:\s*actions/[^@]+@sha256:[0-9a-f]{64}" "$f" || true)
version_tag=$(rg -c "uses:\s*actions/[^@]+@v[0-9]+" "$f" || true)
echo "$f: sha40=$pinned_sha sha256_digest=$pinned_digest version_tag=$version_tag"
doneRepository: gominimal/minimal
Length of output: 3323
Pin GitHub Actions to immutable commit SHAs/digests
.github/workflows/ci-macos.yml uses mutable version tags (e.g., actions/upload-artifact@v7 at line 89), and .github/workflows/promote.yml uses actions/create-github-app-token@v3; pin these uses: references to immutable commit SHAs/digests instead of @v* tags.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 89-89: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci-macos.yml at line 89, Replace mutable GitHub Action
version tags with immutable commit SHAs/digests: locate the `uses:` declarations
`actions/upload-artifact@v7` and `actions/create-github-app-token@v3` and change
them to the corresponding pinned references (owner/repo@sha or
owner/repo@digest) found on the action's marketplace or GitHub repo (use the
latest stable commit SHA or the action's provided digest). Ensure you update
both occurrences and verify the workflow still runs by testing the workflow or
dry-running a workflow dispatch after pinning.
Source: Linters/SAST tools
…updates Bumps the github-actions group with 3 updates in the / directory: [actions/upload-artifact](https://github.com/actions/upload-artifact), [actions/download-artifact](https://github.com/actions/download-artifact) and [actions/create-github-app-token](https://github.com/actions/create-github-app-token). Updates `actions/upload-artifact` from 4 to 7 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v7) Updates `actions/download-artifact` from 4 to 8 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@v4...v8) Updates `actions/create-github-app-token` from 1 to 3 - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](actions/create-github-app-token@v1...v3) --- updated-dependencies: - dependency-name: actions/create-github-app-token dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/github-actions-1d4fa2a04a
branch
from
June 15, 2026 13:57
1a02e9d to
d8af1b5
Compare
Member
|
@dependabot /rebase |
twitchyliquid64
approved these changes
Jun 15, 2026
twitchyliquid64
deleted the
dependabot/github_actions/github-actions-1d4fa2a04a
branch
June 15, 2026 21:55
This was referenced Jun 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions group with 3 updates in the / directory: actions/upload-artifact, actions/download-artifact and actions/create-github-app-token.
Updates
actions/upload-artifactfrom 4 to 7Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
043fb46Merge pull request #797 from actions/yacaovsnc/update-dependency634250cInclude changes in typespec/ts-http-runtime 0.3.5e454baaReadme: bump all the example versions to v7 (#796)74fad66Update the readme with direct upload details (#795)bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)47309c9Merge pull request #754 from actions/Link-/add-proxy-integration-tests02a8460Add proxy integration testb7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEUpdates
actions/download-artifactfrom 4 to 8Release notes
Sourced from actions/download-artifact's releases.
... (truncated)
Commits
3e5f45bAdd regression tests for CJK characters (#471)e6d03f6Add a regression test for artifact name + content-type mismatches (#472)70fc10cMerge pull request #461 from actions/danwkennedy/digest-mismatch-behaviorf258da9Add change docsccc058eFix linting issuesbd7976bAdd a setting to specify what to do on hash mismatch and default it toerrorac21fcfMerge pull request #460 from actions/danwkennedy/download-no-unzip15999bfAdd note about package bumps974686eBump the version tov8and add release notesfbe48b1Update test names to make it clearer what they doUpdates
actions/create-github-app-tokenfrom 1 to 3Release notes
Sourced from actions/create-github-app-token's releases.
... (truncated)
Changelog
Sourced from actions/create-github-app-token's changelog.
Commits
bcd2ba4chore(main): release 3.2.0 (#370)f24bbd8fix: validate private-key input (#376)363531bdocs: capitalize Git as a proper noun in README (#374)fd28011docs: update procedure to configure Git (#287)85eb8ddfeat: support full repository names inrepositoriesinput (#372)c9aabb8build(deps-dev): bump yaml from 2.8.3 to 2.8.4 in the development-dependencie...e02e816build(deps-dev): bump undici from 7.24.6 to 8.2.0 (#366)8d835bfbuild(deps-dev): bump esbuild from 0.27.4 to 0.28.0 in the development-depend...952a2a7feat: add support for enterprise-level GitHub Apps (#263)43e5c34fix(deps): bump@actions/corefrom 3.0.0 to 3.0.1 in the production-dependenc...