Skip to content

Bump the github-actions group across 1 directory with 3 updates#251

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-f4851cad7a
Open

Bump the github-actions group across 1 directory with 3 updates#251
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-f4851cad7a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 3 updates in the / directory: astral-sh/setup-uv, marocchino/sticky-pull-request-comment and github/codeql-action/upload-sarif.

Updates astral-sh/setup-uv from 8.2.0 to 8.3.2

Commits
  • 11f9893 chore: roll up Dependabot updates (#948)
  • f798556 docs: update version references to v8.3.1 (#946)
  • e80544d chore: update known checksums for 0.11.28 (#947)
  • f98e069 Change update-docs PR labels from 'update-docs' to 'documentation' (#945)
  • cd46263 chore: update known checksums for 0.11.27 (#944)
  • 11245c7 docs: update version references to v8.3.0 (#939)
  • d31148d Strip environment markers from detected uv dependency pins (#938)
  • 17c3989 Fix cache keys for Python version ranges (#937)
  • 3cc3c11 chore(deps): roll up Dependabot updates (#936)
  • 9225f84 chore(deps): bump release-drafter/release-drafter from 7.3.1 to 7.4.0 (#924)
  • Additional commits viewable in compare view

Updates marocchino/sticky-pull-request-comment from 3.0.4 to 3.0.5

Release notes

Sourced from marocchino/sticky-pull-request-comment's releases.

v3.0.5

What's Changed

Full Changelog: marocchino/sticky-pull-request-comment@v3.0.4...v3.0.5

Commits
  • 5770ad5 📦️ Build
  • 2c19060 build(deps-dev): Bump @​biomejs/biome from 2.4.14 to 2.5.2 (#1730)
  • 3d24e5a build(deps-dev): Bump js-yaml from 4.1.1 to 5.2.1 (#1732)
  • 3604821 build(deps-dev): Bump @​rollup/plugin-commonjs from 29.0.2 to 29.0.3 (#1710)
  • a4d9c0f build(deps-dev): Bump @​types/node from 25.9.1 to 26.1.0 (#1731)
  • ae65a58 build(deps-dev): Bump vitest from 4.1.7 to 4.1.9 (#1719)
  • 8680321 build(deps-dev): Bump vite from 8.0.13 to 8.0.16 (#1720)
  • 5d40239 build(deps): Bump actions/checkout from 6 to 7 (#1721)
  • 39ab01d build(deps-dev): Bump rollup from 4.60.4 to 4.62.2 (#1722)
  • b2660f1 build(deps): Bump undici from 6.24.0 to 6.27.0 (#1725)
  • Additional commits viewable in compare view

Updates github/codeql-action/upload-sarif from 4.36.2 to 4.37.0

Release notes

Sourced from github/codeql-action/upload-sarif's releases.

v4.37.0

  • Update default CodeQL bundle version to 2.26.0. #3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

v4.36.3

No user facing changes.

Changelog

Sourced from github/codeql-action/upload-sarif's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #4007

4.37.1 - 16 Jul 2026

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #3956
  • Update default CodeQL bundle version to 2.26.1. #4019

4.37.0 - 08 Jul 2026

  • Update default CodeQL bundle version to 2.26.0. #3995
  • In addition to the existing input format, the config-file input for the codeql-action/init step will soon support a new [owner/]repo[@ref][:path] format. All components except the repository name are optional. If omitted, owner defaults to the same owner as the repository the analysis is running for, ref to main, and path to .github/codeql-action.yaml. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. #3973

4.36.3 - 01 Jul 2026

No user facing changes.

4.36.2 - 04 Jun 2026

  • Cache CodeQL CLI version information across Actions steps. #3943
  • Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. #3937
  • Update default CodeQL bundle version to 2.25.6. #3948

4.36.1 - 02 Jun 2026

No user facing changes.

4.36.0 - 22 May 2026

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.19.4. #3894
  • Add support for SHA-256 Git object IDs. #3893
  • Update default CodeQL bundle version to 2.25.5. #3926

4.35.5 - 15 May 2026

  • We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. #3899

... (truncated)

Commits
  • 99df26d Merge pull request #3996 from github/update-v4.37.0-c7c896d71
  • 31c2707 Add changenote for #3973
  • 72df218 Update changelog for v4.37.0
  • c7c896d Merge pull request #3995 from github/update-bundle/codeql-bundle-v2.26.0
  • 3f34ff0 Add changelog note
  • 43bec09 Update default bundle to codeql-bundle-v2.26.0
  • f58f0d1 Merge pull request #3973 from github/mbg/repo-props/config-file-shorthands
  • 7dc37cb Merge remote-tracking branch 'origin/main' into mbg/repo-props/config-file-sh...
  • 8e22350 Thread ActionState to initConfig
  • 69c9e8c Mark some status-report imports as type-only to avoid circular dependencies
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 15, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 15, 2026 09:36
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 15, 2026
@github-actions

github-actions Bot commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown

🐍 Python 3.14 Results

Metric Status Value
Ruff ✅ 0 issue(s)
Unit Tests ✅ success
Code Coverage 📊 100%

Full Workflow Logs

@github-actions

github-actions Bot commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown

🐍 Python 3.13 Results

Metric Status Value
Ruff ✅ 0 issue(s)
Unit Tests ✅ success
Code Coverage 📊 100%

Full Workflow Logs

@github-actions

github-actions Bot commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Python 3.14 Detailed Test Results

1 961 tests  ±0   1 961 ✅ ±0   16s ⏱️ -8s
    1 suites ±0       0 💤 ±0 
    1 files   ±0       0 ❌ ±0 

Results for commit cffe0a0. ± Comparison against base commit f0a66fd.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown

🐍 Python 3.12 Results

Metric Status Value
Ruff ✅ 0 issue(s)
Unit Tests ✅ success
Code Coverage 📊 100%

Full Workflow Logs

@github-actions

github-actions Bot commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Python 3.13 Detailed Test Results

1 961 tests  ±0   1 961 ✅ ±0   21s ⏱️ -3s
    1 suites ±0       0 💤 ±0 
    1 files   ±0       0 ❌ ±0 

Results for commit cffe0a0. ± Comparison against base commit f0a66fd.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Python 3.12 Detailed Test Results

1 961 tests  ±0   1 961 ✅ ±0   22s ⏱️ -2s
    1 suites ±0       0 💤 ±0 
    1 files   ±0       0 ❌ ±0 

Results for commit cffe0a0. ± Comparison against base commit f0a66fd.

♻️ This comment has been updated with latest results.

@dependabot
Bump the github-actions group across 1 directory with 3 updates
cffe0a0 
Bumps the github-actions group with 3 updates in the / directory: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv), [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action).


Updates `astral-sh/setup-uv` from 8.2.0 to 8.3.2
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@fac544c...11f9893)

Updates `marocchino/sticky-pull-request-comment` from 3.0.4 to 3.0.5
- [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases)
- [Commits](marocchino/sticky-pull-request-comment@0ea0beb...5770ad5)

Updates `github/codeql-action/upload-sarif` from 4.36.2 to 4.37.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@8aad20d...99df26d)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 8.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/upload-sarif
  dependency-version: 4.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: marocchino/sticky-pull-request-comment
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the github-actions group with 3 updates Bump the github-actions group across 1 directory with 3 updates Jul 22, 2026
Copilot AI review requested due to automatic review settings July 22, 2026 09:36
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-f4851cad7a branch from 39fd393 to cffe0a0 Compare July 22, 2026 09:36
Copilot AI reviewed Jul 22, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

This PR updates pinned GitHub Action versions used in CI workflows to newer releases.

Changes:

  • Bumps github/codeql-action/upload-sarif in the scorecard workflow.
  • Bumps astral-sh/setup-uv and marocchino/sticky-pull-request-comment in the Python test workflow.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File Description
.github/workflows/scorecard.yml Updates pinned upload-sarif CodeQL action version.
.github/workflows/python-tests.yml Updates pinned setup-uv and sticky-pull-request-comment action versions.

Comment thread .github/workflows/scorecard.yml
Comment thread .github/workflows/python-tests.yml
Comment thread .github/workflows/python-tests.yml
Copilot AI review requested due to automatic review settings July 22, 2026 09:36
Copilot AI reviewed Jul 22, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comment thread .github/workflows/scorecard.yml
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@simonkurtz-MSFT simonkurtz-MSFT simonkurtz-MSFT approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@simonkurtz-MSFT