Update github actions (main) (patch) by red-hat-konflux[bot] · Pull Request #3279 · conforma/cli

red-hat-konflux · 2026-05-09T02:54:07Z

This PR contains the following updates:

Package	Type	Update	Change
actions/cache	action	patch	`v5.0.4` → `v5.0.5`
actions/checkout	action	patch	`v6.0.2` → `v6.0.3`
peter-evans/create-pull-request	action	patch	`v8.1.0` → `v8.1.1`

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

Release Notes

actions/cache (actions/cache)

`v5.0.5`

Compare Source

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in #1747

Full Changelog: actions/cache@v5...v5.0.5

actions/checkout (actions/checkout)

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

peter-evans/create-pull-request (peter-evans/create-pull-request)

`v8.1.1`: Create Pull Request v8.1.1

Compare Source

What's Changed

build(deps-dev): bump the npm group with 2 updates by @dependabot[bot] in #4305
build(deps): bump minimatch by @dependabot[bot] in #4311
build(deps): bump the github-actions group with 2 updates by @dependabot[bot] in #4316
build(deps): bump @tootallnate/once and jest-environment-jsdom by @dependabot[bot] in #4323
build(deps-dev): bump undici from 6.23.0 to 6.24.0 by @dependabot[bot] in #4328
build(deps-dev): bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #4334
build(deps): bump picomatch by @dependabot[bot] in #4339
build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by @dependabot[bot] in #4344
build(deps-dev): bump the npm group with 3 updates by @dependabot[bot] in #4349
fix: retry post-creation API calls on 422 eventual consistency errors by @peter-evans in #4356

Full Changelog: peter-evans/create-pull-request@v8.1.0...v8.1.1

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

To execute skipped test pipelines write comment /ok-to-test.

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

codecov · 2026-05-09T03:05:12Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	`53.53% <ø> (-0.01%)`	⬇️
generative	`16.94% <ø> (ø)`
integration	`27.91% <ø> (ø)`
unit	`69.02% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

fullsend-ai-review · 2026-06-04T02:18:49Z

Review

Findings

High

[protected-path] .github/workflows/ — All 6 changed files are under the .github/ protected path (checks-codecov.yaml, codeql.yaml, lint.yaml, release.yaml, scorecard.yml, update-go-containerregistry.yaml). The PR has no linked issue providing authorization for modifying governance/infrastructure files. Human approval is required for all protected-path changes.
Remediation: A human reviewer with appropriate permissions must approve this PR. Consider linking a tracking issue that authorizes CI dependency updates.

Info

[supply-chain-verification] .github/workflows/checks-codecov.yaml — The PR bumps three GitHub Actions to new patch versions (actions/checkout v6.0.2→v6.0.3, actions/cache v5.0.4→v5.0.5, peter-evans/create-pull-request v8.1.0→v8.1.1) using full SHA pins. All instances across all 6 workflow files are consistently updated. No permissions, run steps, or workflow structure changes are introduced. SHA-to-tag mappings should be verified against upstream GitHub releases.
[sub-agent-failure] N/A — The style-conventions and intent-coherence sub-agents did not return findings: model claude-sonnet-4-5@20250929 is not available on the deployment. These are sonnet-tier (non-blocking) dimensions; correctness and security reviews completed successfully.

Previous run

Review

Findings

Medium

[protected-path] .github/workflows/ — All 6 modified files are under the .github/ protected path. This is an automated Renovate patch-version bump (actions/cache v5.0.4→v5.0.5, actions/checkout v6.0.2→v6.0.3, peter-evans/create-pull-request v8.1.0→v8.1.1) with clear rationale, but human approval is always required for protected-path changes regardless of context.

Info

[sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model claude-sonnet-4-5@20250929 is not available on the deployment. This dimension is non-critical for a SHA-pin-only dependency update.

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

fullsend-ai-review

See the review comment for full details.

red-hat-konflux Bot added main renovate labels May 9, 2026

red-hat-konflux Bot enabled auto-merge May 9, 2026 02:54

red-hat-konflux Bot added renovate main labels May 9, 2026

github-actions Bot added the size: XS label May 9, 2026

red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/patch-github-actions branch 3 times, most recently from 63233a0 to 197c8d6 Compare May 9, 2026 02:55

red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/patch-github-actions branch 5 times, most recently from 47b42ac to 68bd7f0 Compare May 21, 2026 02:43

red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/patch-github-actions branch 3 times, most recently from df77d1f to c0069f3 Compare June 4, 2026 02:13

fullsend-ai-review Bot added the requires-manual-review Review requires human judgment label Jun 4, 2026

Update github actions

aec622c

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>

red-hat-konflux Bot force-pushed the konflux/mintmaker/main-main/patch-github-actions branch from c0069f3 to aec622c Compare June 5, 2026 02:37

fullsend-ai-review Bot suggested changes Jun 5, 2026

View reviewed changes

fullsend-ai-review Bot removed the requires-manual-review Review requires human judgment label Jun 5, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update github actions (main) (patch)#3279

Update github actions (main) (patch)#3279
red-hat-konflux[bot] wants to merge 1 commit into
mainfrom
konflux/mintmaker/main-main/patch-github-actions

red-hat-konflux Bot commented May 9, 2026 •

edited

Loading

Uh oh!

codecov Bot commented May 9, 2026 •

edited

Loading

Uh oh!

fullsend-ai-review Bot commented Jun 4, 2026 •

edited

Loading

Review

Findings

Medium

Info

Uh oh!

fullsend-ai-review Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

red-hat-konflux Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v5.0.5

What's Changed

v6.0.3

v8.1.1: Create Pull Request v8.1.1

What's Changed

Configuration

Documentation

Uh oh!

codecov Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

fullsend-ai-review Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review

Findings

High

Info

Review

Findings

Medium

Info

Uh oh!

fullsend-ai-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

red-hat-konflux Bot commented May 9, 2026 •

edited

Loading

`v5.0.5`

`v6.0.3`

`v8.1.1`: Create Pull Request v8.1.1

codecov Bot commented May 9, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 4, 2026 •

edited

Loading