Repository navigation
build(deps): bump actions/setup-python from 7.0.0 to 7.1.0 - #6719
Conversation
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 7.0.0 to 7.1.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@5fda3b9...6d4fd22) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![aethersdr-agent[bot]](https://avatars.githubusercontent.com/in/3286087?s=60&v=4){kind=small}
There was a problem hiding this comment.
Issue fit
No linked issue, and none is wanted: .github/dependabot.yml is the standing authorization for exactly this change (package-ecosystem: "github-actions", weekly). GOVERNANCE.md asks for an RFC for architectural change and an issue for bug fixes with a root cause — a scheduled dependency bump is neither. The PR also follows the convention written into that config:
Convention: pin actions to a full commit SHA with NO trailing
# vXversion comment — Dependabot bumps the SHA but doesn't keep such comments in sync, so they drift and mislead (see #3864).
.github/workflows/static-checks.yml:176 is a bare SHA with no trailing comment. Compliant.
I verified the title's claim rather than taking it: both SHAs resolve against the live actions/setup-python API to the tag objects they claim. 5fda3b95a4ea91299a34e894583c3862153e4b97 is v7.0.0; 6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 is v7.1.0.
Scope
| File | What it changes | Claimed by the title? | Verdict |
|---|---|---|---|
.github/workflows/static-checks.yml:176 |
actions/setup-python pin SHA, v7.0.0 → v7.1.0 |
Yes | In scope |
One line, one pin, nothing else. grep -rn "setup-python@" .github/workflows/ returns exactly this one call site, so there is no sibling pin left on the old SHA. Everything in the diff is explained by the title.
Blockers
None.
Nits
None. Both severities' worth of CodeGuard output refuted below rather than carried.
CodeGuard findings — all 15 refuted
Confirmed by the security-audit subagent (CodeGuard) and independently by me; none survives, and none touches the changed line.
- CS-VLN-CMDI-BACKTICK ×11 (lines 14, 36, 81, 172, 317, 340, 348, 363, 407, 422, 477) — every one is a backtick inside a YAML
#comment, e.g.static-checks.yml:477:# silently pass an empty base to \git worktree add`.` No shell parses these. This is the known lexical behaviour of the rule. - CS-VLN-CMDI-BACKTICK at
static-checks.yml:544— the only flagged backtick in an executedrun:body:The backticks are backslash-escaped, so bash emits literals and performs no substitution, and the heredoc is written toThis PR touches \`src/gui/\` files with **${{ steps.a11y.outputs.findings }}** accessibility issue(s)./tmp/a11y_comment.md— never executed. Lines 549–552 use the identical escaped form and were not flagged, which locates the inconsistency in the detector. - CS-VLN-CMDI-ENVVAR at
static-checks.yml:483and:498—${BASE_REF}comes fromBASE_REF: ${{ github.base_ref }}in theenv:block (lines 481, 496). Routing throughenv:instead of interpolating${{ }}into the script text is the mitigation this rule class asks for, the variable is double-quoted at both uses, andgithub.base_refis the PR's target branch — an existing ref in this repo, which a fork author cannot create. - CS-VLN-CMDI-ENVVAR at
static-checks.yml:547—${SUMMARY}is the allow-listgrep -E "(Files scanned|Files with findings|Total findings)"of our owntools/check_a11y.pyoutput, expanding into file content, not a command position.
What I tried to break
- "It's really v7.1.0." Resolved both pins against the upstream tag refs (live API, not inferred from the title) — they match exactly.
compare 5fda3b9...6d4fd22is 16 ahead, 0 behind, so this is a strict forward move, not a lateral ref or a revert dressed as a bump. - A silent behaviour change in the action's contract. Diffed
action.ymlacross the two SHAs: the only additions aremirrorandmirror-token. Our step passespython-version: "3.12"and nothing else, so the new surface is unexercised, and themirrordefault (https://raw.githubusercontent.com/actions/python-versions/main) reconstructs the exact v7.0.0 manifest URL. Noruns:change, so the Node runtime is unchanged. - A regression in the token path. Read
src/install-python.ts: v7.0.0 passedAUTHtotc.downloadTool(downloadUrl, ...)unconditionally; v7.1.0 routes it throughauthForUrl(), which sends the token only to GitHub-owned hosts. That is a hardening, not a regression. Manifest fetch order (GitHub API → raw URL fallback) is preserved at the default mirror, since the default parses as repo coords. - The
@actions/cache6.3.0 upgrade riding along in the bump. Inert for us — our step sets nocache:input, so the cache distributor never runs. - Whether a bumped action could escalate anything here. The workflow is
pull_request, notpull_request_targetorworkflow_run;permissions:is explicitlycontents: read/pull-requests: write; the only secret in the file isGITHUB_TOKENat line 537, and fork PRs get a read-only one. There is no privilege for a compromised action version to reach. - Verified at runtime, not reasoned:
Static checks— the job that actually consumes this pin — is green on headaaa9906, alongsidebuild,check-windows,check-macosandSanitizer option configures. The new SHA resolved and the action ran. Everything else above is reasoned from the diff and from upstream sources I read, not reproduced locally. - Honest boundary: I cannot verify that upstream's
dist/setup/index.js(±54k lines in this delta) was built from thesrc/I reviewed. That is the standard supply-chain gap for any bundled JS action, unchanged by this PR, and mitigated here by pinning to a tag commit on a GitHub-owned repository.
Recommendation
Approve. The single claim this PR makes is verified against upstream, the delta is a strict forward move whose only new surface is opt-in and unused by our call site, and the one behavioural change at default settings narrows where the token is sent. All 15 CodeGuard findings are pre-existing lexical false positives on untouched lines. Next step is simply to merge; no changes requested.
(Review event is COMMENT by policy — a human maintainer still makes the merge call.)
🤖 aethersdr-agent · cost: $5.6990 · model: claude-opus-5
|
Cisco CodeGuard — static analysis of this PR (15 finding(s))
Automated static scan by Cisco DefenseClaw CodeGuard on the changed files. Advisory — some may be false positives; the review above verifies them. 🤖 aethersdr-agent · cost: $5.7870 · model: claude-opus-5 |
NF0T
left a comment
NF0T
left a comment
There was a problem hiding this comment.
Approving. This is a clean single-pin Dependabot bump, and I checked each claim against upstream myself instead of carrying over the agent review above. My conclusions match it.
Scope
| File | Change | Claimed by title? | Verdict |
|---|---|---|---|
.github/workflows/static-checks.yml:176 |
actions/setup-python pin 5fda3b9 → 6d4fd22 |
Yes | In scope |
One line. git grep "setup-python@" on main finds only this call site, so no sibling pin is left on the old SHA. The pin is a bare SHA with no trailing # vX comment, which is the convention in .github/dependabot.yml (#3864). This is a dependency bump, not a change to existing behaviour, so the preference-vs-fix question doesn't apply. .github/dependabot.yml is the standing authorization, so no issue link is needed.
What I checked
- The pins are the versions the title says.
git/ref/tags/v7.0.0resolves to5fda3b95…andv7.1.0to6d4fd22b…, both lightweight tags on GitHub's own repo.compare 5fda3b9...6d4fd22is 16 ahead, 0 behind, so it is a strict forward move and not a lateral or reverted ref. - The action's contract. I diffed
action.ymlbetween the two SHAs. The only additions are the optionalmirror/mirror-tokeninputs plus a description tweak ontoken. Our step passes onlypython-version: "3.12", and themirrordefault is the sameraw.githubusercontent.com/actions/python-versions/mainsource as before.runs.usingisnode24on both sides, so the runtime is unchanged. - The token path. In v7.0.0
src/install-python.tspassesAUTHtotc.downloadToolunconditionally (line 294). In v7.1.0 the token goes throughauthForUrl()for both the manifest and the download (lines 390, 444). That narrows where the token is sent, which is a hardening and not a regression. - Blast radius. The workflow triggers on
pull_requestonly, notpull_request_targetorworkflow_run, andpermissions:iscontents: read/pull-requests: write. A bumped action has no extra privilege to reach. - Runtime, not just reasoning. The
Static checksjob log on headaaa9906(eventpull_request, so this is the merge result) showsDownload action repository 'actions/setup-python@6d4fd22…'andSuccessfully set up CPython (3.12.15). The job is green, and so arebuild,check-windows,check-macosandSanitizer option configures. - The CodeGuard findings all fall on lines this PR doesn't touch (YAML comments, escaped backticks in a heredoc,
env:-routed refs). I agree with the agent review that they are pre-existing false positives, and none is attributable to this diff.
What I couldn't verify: whether the bundled dist/ was built from the src/ I read. That is the usual gap for any bundled JS action, and pinning to a tag commit on a GitHub-owned repo is the mitigation we already rely on.
Process
The commit is signed (verified, valid). No Constitution principle is engaged. Earlier Dependabot squashes on main (#6343, #6342, #5955) carry the bare Dependabot subject, and I'm keeping that precedent. Tier 2 (.github/workflows/ → @aethersdr/infrastructure).
Merging as-is.
73,
Ryan NF0T
👨🏼💻 Co-authored by Claude Opus 5.5
Bumps actions/setup-python from 7.0.0 to 7.1.0.
Release notes
Sourced from actions/setup-python's releases.
Commits
6d4fd22Cache upgrade to 6.3.0 (#1370)ec52d0aBump@typescript-eslint/eslint-pluginfrom 8.62.0 to 8.71.1 (#1369)ff73b24Bump prettier from 3.8.4 to 3.9.9 and package.json from 7.0.0 to 7.1.0 (#1363)0e40890Bump brace-expansion from 5.0.9 to 5.0.12 (#1365)3892123Bump ts-jest from 29.4.11 to 29.4.14 (#1361)6609657Bump undici from 6.28.0 to 6.29.0 (#1364)e1be392Bump@types/semverfrom 7.7.1 to 7.8.0 (#1359)06da627Bump@vercel/nccfrom 0.44.0 to 0.45.0 (#1357)af9bcc7Bump eslint-plugin-jest from 29.15.2 to 29.16.6 (#1342)7aeabebBump@typescript-eslint/parserfrom 8.62.0 to 8.70.0 (#1343)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)