Update github-actions dependencies - #4684
Conversation
Dependency bump review — reviewed, looks clean ✅Verified each pinned digest against upstream and read the commit log for every bumped range. No findings. Digest / comment accuracy
All references in Regression analysis
Secrets / PIIThe diff itself adds no new stdout, stderr, or log output. The two upstream log-surface changes noted above ( |
b725156 to
f9ba29f
Compare
Renovate bump review — no findingsReviewed per 1. Pin integrity — all four SHAs match their claimed tags
(The codeql-action and release-drafter refs are annotated tags, so 2. Upstream regression analysis
VerdictNo inline findings. No secret/PII exposure introduced on any reachable path, and no behavioral regression given this repo's configuration. |
f9ba29f to
2e5f29c
Compare
Renovate bump review — looks clean ✅Reviewed per Pin integrity — every new SHA was resolved against the upstream repo and matches the version in its trailing comment (annotated tags dereferenced):
All four ranges are fast-forwards ( Upstream changes in each bumped range, against how we actually use them:
No new logging of credentials or PII is introduced on any path this repo exercises. |
2e5f29c to
4cf47e2
Compare
Dependency bump review — no findingsReviewed per Digest ↔ tag verification
Every pin is an ancestor-clean fast-forward ( Regression analysis
Worth noting that #363 (composite: skip synthetic parallel parents) fixes the interaction between #362 and composite expansion. This repo sets
🤖 Generated with Claude Code |
4cf47e2 to
0602549
Compare
Renovate review — GitHub Actions bumps ✅Reviewed per Digest ↔ tag verificationAll five pinned digests resolve to the tag claimed in the trailing comment (no mismatched or unreleased pins):
All 9 call sites were updated consistently — no stale digests left anywhere in Upstream commit-log / release-notes review
|
0602549 to
715b07e
Compare
Dependency bump review — reviewed, looks clean ✅Reviewed per Pin integrityEvery pinned SHA resolves to the tag in its trailing comment, and every range is ahead-only on the upstream default branch (
Secrets / PII in logsOne thing flagged and cleared: Per-action regression notes
Only |
715b07e to
2e554db
Compare
Renovate GitHub Actions bump — reviewed, looks clean ✅No findings; nothing blocking. Details of what was checked, per Pinned SHA ↔ tag verificationEvery new SHA was resolved against the upstream ref it claims in the trailing comment (annotated tags dereferenced):
All four ranges are fast-forward ( Upstream release notes / commit log reviewSwatinem/rust-cache — effectively v2.9.1 → v2.9.2 (45 commits; the old pin was one commit past
docker/login-action
release-drafter v7.6.0 → v7.7.0 (20 commits).
Kesin11/actions-timeline v3.1.1 → v3.2.0 (37 commits). Adds rendering for GitHub's new Secrets/PII in logsNo change in this PR adds or alters stdout/stderr/log output in this repo, and the one upstream change that adds logging (release-drafter #1674) prints only repo/path/ref. One thing to keep an eye on: |
2e554db to
33d58f1
Compare
Renovate bump review — clean ✅Reviewed per ProvenanceAll four digests dereference exactly to the tags the comments claim, and every range is a clean fast-forward (
Version comments are accurate after the bump, and all 7 occurrences across the 7 workflows were updated consistently — no file left on a stale digest. Regression analysis
🤖 Generated with Claude Code |
33d58f1 to
6426f5d
Compare
Renovate bump review — clean ✅Reviewed all four action bumps against upstream release notes and commit logs. No findings; nothing to block on. Pin verificationEvery SHA resolves to the tag its trailing comment claims:
Per-dependency regression analysis
Secrets / PII checkNo new stdout, stderr, or log output is introduced by this diff. The only upstream logging widening (login-action's Docker Hub error body) is unreachable from our workflows, as noted above. 🤖 Generated with Claude Code |
6426f5d to
aaeef33
Compare
Review: GitHub Actions dependency bump — no findingsReviewed per Pin verificationEvery pinned SHA resolves to the tag its trailing comment claims, and the digest updates span real releases (Renovate labels them "digest", which understates them):
Also checked: no stale copies of the old SHAs remain anywhere in the repo, and all 7 call sites are updated consistently. Regression assessment per action
Secrets / PII in logs (high-severity check)No new secret or PII exposure. Two things looked at explicitly:
Note that CI evidence on this PRThe two bumps this PR's own CI can exercise both ran green with the new pins:
|
🔄 Flaky Test DetectedAnalysis: Five MySQL→ClickHouse e2e tests all hit the same hard-coded 60s mirror-status poll timeout while still in STATUS_SETUP/STATUS_SNAPSHOT on one matrix leg, while the same commit passed on the pg16 and pg18 legs and the PR only bumps GitHub Action pins — indicating runner resource contention, not a code defect. ✅ Automatically retrying the workflow |
e2f088a to
cbaae1f
Compare
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| dir: "nexus/server/tests/assets/" | ||
|
|
||
| - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 | ||
| - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2 |
There was a problem hiding this comment.
rust-cache v2.9.1 -> v2.9.2 silently changes the cache-key digest — expect one cold build here.
Not a defect in this PR, and not blocking, but it isn't in the upstream changelog so it would otherwise surface as an unexplained CI slowdown: the nexus cache is invalidated once by this bump, so the first post-merge run of cargo check / cargo test is cold on all five postgres-version matrix legs, then re-warms.
Why — src/config.ts in the bumped range changed getRustVersions from a Set of RustVersion objects to a Set of strings:
- Before,
parseRustVersionreturned a fresh object per call, so the Set never deduped, andrustVersions.sort()over objects was a no-op (every element stringifies to[object Object]). - Now the entries are
"<release> <host> <commit-hash>"strings, so they genuinely dedupe and sort.
This workspace has no rust-toolchain.toml and ci.yml installs no toolchain, so Rust comes from the preinstalled rustup on ubuntu-latest. There, rustc -vV and rustup run stable-x86_64-unknown-linux-gnu rustc -vV yield the same version string: v2.9.1 fed it to the sha1 hasher twice, v2.9.2 feeds it once, so the digest differs. add-rust-environment-hash-key defaults to true, and that digest is appended to key before self.restoreKey = key, so the restore-key prefix changes too and even the prefix-based partial restore misses.
Two more items from the same range, both inert for this repo but worth recording:
buildjetcache provider removed.getCacheProvider()dropped thebuildjetcase, socache-provider: buildjetnow throws. This step uses the defaultgithub, so no impact.credentials.tomlcleanup now actually fires. The pre-save unlink path was wrong (CARGO_HOME/.cargo/credentials.toml) and is fixed toCARGO_HOME/credentials.toml. Prior versions therefore never scrubbed it, meaning a cargo registry token in~/.cargo/credentials.tomlcould be baked into the saved Actions cache. This job sets no registry token, so nothing was exposed, but the fix is a genuine improvement.
The cleanup rewrites in this range (cleanTargetDir profile detection inverted, keepPkg widened to target names, exact-match-before-hash-strip in rmExcept for Cargo's V2 build-dir layout, SAVE_TARGETS widened to cdylib/dylib/rlib/staticlib) all err toward preserving more artifacts, so the failure mode is a larger cache rather than lost build output. cleanBin also became stricter — it now deletes exactly the recorded pre-existing binaries instead of everything not attributable to a cargo install, which no longer risks removing rustup shims.
The other three bumps check out. All pins resolve to their commented tags (57fc93f = actions-timeline v3.2.0, dbcb813 = login-action v4 -> v4.6.0, 34d8067 = release-drafter v7 -> v7.7.0), none has a follow-up patch release suggesting a regression, and no new stdout/stderr/log output in any of them can reach a secret as this repo uses them. login-action: the widened Docker Hub error body (whole response stringified instead of four known keys) only runs on the Docker Hub OIDC path — all four call sites here are ghcr.io with username/password — and the scopeToConfigDir path-traversal hardening is a security fix on an input this repo never passes. release-drafter: the new conventional-title categorization is opt-in via a conventional: key under a category's when, and .github/release-drafter.yml here declares no categories, so drafted notes are unchanged; the no-new-contributor-template addition only affects the contributors placeholder and this template is just the changes placeholder. The one thing not verifiable from outside is the GraphQL pagination refactor (hand-rolled paginator replaced with Octokit's), which in principle could change which PRs land in a draft. actions-timeline: v3.2.0's "skip synthetic parallel parents" fix specifically targets expand-composite-actions: true, which tilt-flow.yml sets — so a fix, not a regression, and observability-only either way.
Renovate bump review — no findingsReviewed per Pin ↔ tag verification (each new SHA resolves to the tag in the trailing comment):
All occurrences in Upstream release-notes / commit-log review of the bumped ranges:
No secret/PII logging introduced, no breaking input or behavior changes for how this repo uses these actions, and no upstream regressions that apply here. |
cbaae1f to
e27d362
Compare
Renovate bump review — reviewed, looks clean ✅Reviewed per SHA ↔ version verificationEvery new SHA resolves to the exact upstream release tag claimed by the version comment — no digest points at an unreleased/main-branch commit:
All 7 files are updated consistently — Upstream change review
Secret / PII logging checkNo new stdout/stderr/log output that could carry credentials. The only changed error-message formatting is the Docker Hub OIDC path noted above, which these workflows do not exercise; GitHub secret masking applies regardless. |
c9bd8f5 to
1be0720
Compare
Dependency bump review — clean ✅Reviewed per Pin integrity — every SHA was resolved against the upstream repo and matches its version comment, and each new SHA is a descendant of the old one (no lineage swaps):
Regression check against the bumped ranges
No secret/PII exposure introduced, no cache-key or config-schema breakage, and no cross-repo version drift left behind. |
1be0720 to
20db512
Compare
Renovate GitHub Actions bump — reviewed, looks clean ✅Reviewed per Digest → tag verificationEvery new pin was resolved against the upstream repo's tag refs. All five land on real, tagged upstream releases; every compare is
Upstream release-note review
Go 1.26.5 → 1.26.6 — patch release. All three Secret / PII in logsNo new |
20db512 to
e8c0847
Compare
Renovate bump review — no findings ✅Reviewed per SHA ↔ version comment verification
Go 1.26.5 → 1.26.6 — patch release, 26 backports to docker/login-action
Remainder is dependency bumps. Swatinem/rust-cache release-drafter Kesin11/actions-timeline v3.1.1 → v3.2.0 — adds parallel-step rendering and reworks composite-action matching to skip synthetic parallel parents. This repo sets |
e8c0847 to
7e6c16c
Compare
Renovate bump review — no findingsReviewed per Digest ↔ tag verificationEvery new SHA was verified against the upstream tag it claims in the trailing comment — no mismatches, no digests pointing at un-tagged branch heads:
Upstream release-notes / commit-log review
Go 1.26.5 → 1.26.6. Patch bump, applied consistently to all three Consistency sweepAll four Note: |
7e6c16c to
6ecf8bb
Compare
Renovate review — verified, looks clean ✅Automated review ran (per Digest ↔ tag verification (supply-chain check)Every pinned SHA was resolved against the upstream repo — all match a real release tag, none are unreachable or off-tag:
Regression review of the bumped ranges
Go 1.26.5 → 1.26.6 ( Secrets / PII in logsNo changes in this diff add stdout, stderr, or log output. Nothing prints credentials, tokens, or connection details. |
6ecf8bb to
baf4540
Compare
Renovate review — no findingsReviewed per Digest pins verified against upstreamEach pinned SHA was resolved against the upstream repo to confirm it matches the tag the trailing comment claims:
No mismatched or unreachable digests, and no comment drift. Release-note review per bumpGo 1.26.5 → 1.26.6 — 1.26.6 is a security release (fixes in Note: 1.26.7 (
Secrets / PIINo new 🤖 Reviewed with Claude Code |
🔄 Flaky Test DetectedAnalysis: All failures are WaitFor/status polling timeouts (mostly BigQuery e2e tests) that differ between two matrix shards while a third shard passed entirely, on a Renovate PR that only bumps GitHub Action pins — indicating slow/overloaded CI rather than a code regression. ✅ Automatically retrying the workflow |
🔄 Flaky Test DetectedAnalysis: All failures are BigQuery-only "UNEXPECTED TIMEOUT" waits for sync/normalization, hitting different tests in each matrix leg within the same time window, on a Renovate GitHub-Actions digest bump that cannot affect BQ behavior — consistent with transient BigQuery ingestion latency rather than a code regression. ✅ Automatically retrying the workflow |
baf4540 to
0b92890
Compare
Dependency bump review — no findingsReviewed per SHA pin verificationEvery pinned digest was resolved against the upstream repo (annotated tags dereferenced) and matches the version claimed in the trailing comment — no digest/comment mismatch, no unexpected commit:
No stale copies of the old digests remain anywhere in the repo, and all three Regression assessment of the bumped rangesGo 1.26.5 → 1.26.6 — security/bugfix point release (27 commits on Swatinem/rust-cache → 2.9.2 (
docker/login-action → v4.6.0 (4 docker workflows) — two behaviour changes, neither reachable from our usage:
Kesin11/actions-timeline → v3.2.0 ( release-drafter → v7.7.0 ( Verdict: bump is clean, digests are trustworthy, and no regression affects a code path this repo exercises. 👍 |
0b92890 to
1ab2619
Compare
Dependency bump review — no findings ✅Reviewed all 5 GitHub Actions bumps per Digest provenance — every pinned SHA dereferences to the release its trailing comment claims:
All four still declare Regression assessment per bump
Secrets/PII check: no bump introduces new logging of credentials, tokens, or PII on any code path this repo exercises. CI is green on the PR (build matrix, docker-build, CodeQL, lint all passing). |
🔄 Flaky Test DetectedAnalysis: All failures are 60s WaitFor/status-poll timeouts (CDC not caught up in time) hitting disjoint test sets across two matrix legs while a third leg passed fully, on a Renovate PR that only bumps pinned GitHub Action SHAs and cannot affect replication behavior — consistent with resource contention under ✅ Automatically retrying the workflow |
🔄 Flaky Test DetectedAnalysis: TestApiPg/TestResyncWithSnapshotConfigOnPausedPipe timed out after 180s waiting for the flow to be dropped during teardown (api_test.go:1810) on only one of three matrix legs, in a Renovate PR that changes GitHub Actions versions only — all functional assertions in the test passed. ✅ Automatically retrying the workflow |
1ab2619 to
238a984
Compare
Renovate review —
|
| Action | New SHA | Resolves to |
|---|---|---|
Swatinem/rust-cache |
6323deb |
v2 → v2.9.2 ✅ |
docker/login-action |
dbcb813 |
v4 → v4.6.0 ✅ |
release-drafter/release-drafter |
34d8067 |
v7 → v7.7.0 ✅ |
Kesin11/actions-timeline |
57fc93f |
v3.2.0 ✅ |
All four are ahead / 0 behind relative to the previous pins (no history rewrite, no force-push onto the tag), and every call site in .github/workflows/ was updated consistently — no stale digests left behind.
Upstream change review
- Go 1.26.5 → 1.26.6 — security/bugfix patch:
x/modCVE-2026-56864 and CVE-2026-56865,net/urlquadratic complexity inresolvePath,html/templateregexp tracking,encoding/xml+encoding/asn1recursion-depth hardening,crypto/tlspost-handshake state fix, plus assorted compiler/runtime fixes. Strictly a good bump. All threego-version:pins (cleanup.yml,golang-lint.yml,tilt-flow.yml) were updated; thego.modfiles stay atgo 1.26.0, so no toolchain mismatch. - rust-cache v2.9.1 → v2.9.2 (45 commits) — largest delta here. Functional changes: cargo-bin caching now scans
$CARGO_HOME/binon restore instead of trustingcargo installmetadata (creating all normalized tables in a single activity #325),build/and.fingerprint/cleanup is now target-name aware (increase normalize time #317, WorkFlow Task timeout #320), Cargo V2 build-dir layout support (Support Binary Types in Postgres Query Layer #371), plus an internal esbuild→rollup bundle-split migration. Practical effect for thenexusworkspace inci.yml: expect a one-time cache miss / re-population on the first run after merge (slowercargo check, then back to normal). The one rollup-migration regression in this range (Windows cache-path validation) was fixed by Adds variable assignments in clonetable #355 before this tip, and the runner is Ubuntu anyway. No open regression reports against v2.9.2 upstream. - docker/login-action → v4.6.0 — two behavioral commits, neither reachable from how this repo uses the action: (a) Docker Hub OIDC error surfacing now echoes the parsed JSON error body (UI: Fix caching #1058) — that is the Docker Hub OIDC path only; these workflows log into
ghcr.iowithgithub.actor+ token, so it is not hit, and the echoed content is an API error body, not credentials; (b) buildx scoped-config path-traversal hardening (chore: update dependencies #1059) — only applies when thescopeinput is set, which none of the four call sites use. - release-drafter → v7.7.0 — the new features are opt-in and do not affect
.github/release-drafter.yml(template +version-resolveronly, nocategories): conventional-title categorization (UI: Add create mirror buttons #1556) requires aconventional:predicate in category config, and the new-contributor template (PG to PG: TSTZRange and JSONB #1687) requires$NEW_CONTRIBUTORSin the template. Useful fixes included: proxy-aware fetch preserved in the Octokit client (PopulateCountMap: use atomics #1682) and retry on transient GitHub API failures (Incontinency whit Postgres Schemas with double qutes #1680). The new "log all config sources" (swapping out custom error for errors.ErrUnsupported #1674) logs only config file paths/refs — no token or secret exposure. - actions-timeline v3.1.1 → v3.2.0 — adds rendering for the new GitHub
parallelstep syntax, plus Fix Linux docker-compose error and add TEMPORAL_CSRF_COOKIE_INSECURE=true #363 which skips synthetic parallel parents during composite matching.tilt-flow.ymlsetsexpand-composite-actions: true, so Fix Linux docker-compose error and add TEMPORAL_CSRF_COOKIE_INSECURE=true #363 is the relevant path; it is job-summary rendering only, and the workflow does not useparallel:steps today. No permission-scope change.
Secret/PII check (.claude/REVIEW.md §1): the diff is 10 lines of pin/version changes only — no new run: steps, no added logging, no secret handling touched.
238a984 to
b097fa1
Compare
Renovate bump review — looks clean ✅Reviewed per Digest/version verification — every new pin resolves to a legitimate upstream ref (no arbitrary/unreleased master commits):
Upstream changes in the bumped ranges — regression assessment:
No upstream issues reporting regressions were found for any of the four target versions. Safe to merge. |
b097fa1 to
e68ae07
Compare
|
Renovate review — no findings ✅ Reviewed per Pin integrity Every pinned SHA was verified against the tag asserted in its trailing comment:
All four ranges are strictly Upstream regression check
Go Minor and non-blocking: 🤖 Generated with Claude Code |
1 participant
This PR contains the following updates:
v3.1.1→v3.2.0e18b497→6323debabd2ef4→dbcb8131.26.5→1.26.61.27.0(+1)eada3c9→34d8067Release Notes
Kesin11/actions-timeline (Kesin11/actions-timeline)
v3.2.0Compare Source
Changes
Support new
parallelsyntax.Similar to composite action expansion, an overall parent span is created for steps executed in parallel. Child span names for steps running in parallel in the background are prefixed with (bg).
Sample screenshot:
https://github.com/user-attachments/assets/d92027fc-ded2-4b6e-9ab0-e3923b698ec3
Features
Fixes
Dependencies
13 changes
Internal improvement
v3.2Compare Source
actions/go-versions (go)
v1.26.6: 1.26.6Compare Source
Go 1.26.6
Configuration
📅 Schedule: (in timezone Etc/UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.