Bump the github-actions group with the lockstep and audit follow-ups - #421
Open
jeremy wants to merge 2 commits into
Open
Bump the github-actions group with the lockstep and audit follow-ups#421jeremy wants to merge 2 commits into
jeremy wants to merge 2 commits into
Conversation
Bumps the github-actions group with 6 updates: | Package | From | To | | --- | --- | --- | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.8` | `4.37.9` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.8` | `4.37.9` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.8` | `4.37.9` | | [anchore/sbom-action/download-syft](https://github.com/anchore/sbom-action) | `0.24.0` | `0.24.2` | | [securego/gosec](https://github.com/securego/gosec) | `2.28.0` | `2.29.0` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.6.2` | `0.6.3` | Updates `github/codeql-action/init` from 4.37.8 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@db488dd...cdf488f) Updates `github/codeql-action/analyze` from 4.37.8 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@db488dd...cdf488f) Updates `github/codeql-action/upload-sarif` from 4.37.8 to 4.37.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@db488dd...cdf488f) Updates `anchore/sbom-action/download-syft` from 0.24.0 to 0.24.2 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](anchore/sbom-action@e22c389...3ad7283) Updates `securego/gosec` from 2.28.0 to 2.29.0 - [Release notes](https://github.com/securego/gosec/releases) - [Commits](securego/gosec@9e75c05...deb5446) Updates `zizmorcore/zizmor-action` from 0.6.2 to 0.6.3 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@3dc1ecc...70fb788) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/analyze dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: anchore/sbom-action/download-syft dependency-version: 0.24.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: securego/gosec dependency-version: 2.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.6.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> (cherry picked from commit 9bb9bcd)
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The version and workflow-pin updates are internally consistent (lockstep) and the reusable-workflow reference change is valid for same-repo calls.
Pull request overview
This PR updates GitHub Actions pins in the repository’s CI/security workflows and applies the follow-up fixes needed to keep the repo’s “release lockstep” checks and workflow audits passing.
Changes:
- Bump
GOSEC_VERSIONin the Makefile tov2.29.0to match thesecurego/gosecaction pin. - Update workflow action pins (zizmor, CodeQL upload-sarif, Syft download) to the new SHAs/versions.
- Switch the release workflow’s reusable-workflow call to the same-repo
$/...form.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
File summaries
| File | Description |
|---|---|
| Makefile | Bumps the local gosec tool version to keep release lockstep aligned with CI. |
| .github/workflows/test.yml | Updates zizmor-action pin to the new version/SHA. |
| .github/workflows/security.yml | Updates CodeQL upload-sarif and gosec action pins to the new versions/SHAs. |
| .github/workflows/scorecard.yml | Updates CodeQL upload-sarif pin to the new version/SHA. |
| .github/workflows/release.yml | Uses $/... for the same-repo reusable security workflow and updates Syft download pin. |
| .github/workflows/codeql.yml | Updates CodeQL init/analyze/upload-sarif pins to the new version/SHA. |
Review details
- Files reviewed: 6/6 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
The actions bump moves securego/gosec to v2.29.0, which the release lockstep check compares against the Makefile's GOSEC_VERSION. zizmor 0.6.3 adds the self-repository audit, which wants the reusable security workflow referenced as $/ rather than ./; actionlint v1.7.12, the newest release, rejects that form, and a job-level reusable-workflow call has no earlier step that could swap the checkout, so the finding is suppressed with that reason.
jeremy
force-pushed
the
bump-actions-group
branch
from
September 9, 2026 22:51
85f89da to
7fab2d8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Carries dependabot's github-actions group bump from #415 (codeql-action v4.37.9, sbom-action v0.24.2, gosec v2.29.0, zizmor-action v0.6.3) and the two follow-ups that PR cannot make on its own:
check-release-lockstepcompares the Makefile'sGOSEC_VERSIONagainst thesecurego/gosecpin in security.yml. The bump moved the action to v2.29.0, so the Makefile follows.make gosecat v2.29.0 runs clean locally (0 issues).self-repositoryaudit, which flags release.yml calling the reusable security workflow as./.github/workflows/security.ymland wants GitHub's newer$/form. actionlint v1.7.12 (the newest release) rejects$/outright, so the two linters in that job cannot both be satisfied by the syntax change. The audit's concern is a./reference resolving to a checkout mutated by an earlier step; a job-level reusable-workflow call has no earlier step, so the finding is suppressed on that line with the reason, matching the repo's otherzizmor: ignoremarkers. Worth switching to$/once actionlint parses it.Local gate:
make check(fmt, vet, lint, unit tests, tidy, surface, release lockstep) andmake gosecpass;make test-e2epasses every lockstep and nix test, with the only failures being the fiveinstall_ssh_key.batscases that use GNUstat -cin their assert helper and fail on macOS regardless of branch.Supersedes #415.