Skip to content

deps(ci): Bump the "cicd" group with 1 update across multiple ecosystems - #1042

Merged
tahminator merged 1 commit into
mainfrom
dependabot/cicd-05086d0457
Oct 23, 2026
Merged

deps(ci): Bump the "cicd" group with 1 update across multiple ecosystems#1042
tahminator merged 1 commit into
mainfrom
dependabot/cicd-05086d0457

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the cicd group with 2 updates in the / directory: actions/checkout and actions/github-script.

Updates actions/checkout from 6 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Commits

Updates actions/github-script from 8 to 9

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

  • getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
  • Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

  • require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
  • getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
  • If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

New Contributors

Full Changelog: actions/github-script@v8.0.0...v9.0.0

Commits
  • 3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
  • ca10bbd fix: use @​octokit/core/types import for v7 compatibility
  • 86e48e2 merge: incorporate main branch changes
  • c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
  • afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
  • ff8117e ci: fix user-agent test to handle orchestration ID
  • 81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
  • 3953caf docs: update README examples from @​v8 to @​v9, add getOctokit docs and v9 brea...
  • c17d55b ci: add getOctokit integration test job
  • a047196 test: add getOctokit integration tests via callAsyncFunction
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by CodeRabbit

  • Chores
    • Updated the automation used for builds, tests, and pull request workflows. These maintenance changes do not alter user-facing behavior.

@dependabot
dependabot Bot requested a review from a team October 19, 2026 14:57
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 19, 2026
This was referenced Oct 19, 2026
Closed
Closed
@tahminator
tahminator enabled auto-merge (squash) October 19, 2026 18:00
@pat-agent

pat-agent Bot commented Oct 19, 2026

Copy link
Copy Markdown

Available PR Commands

  • /migrate - Applies this PR's database migrations to the staging DB (can only be run by someone on @Patina-Network/codebloom)
  • /copy - Triggers copy from production to staging db (can only be run by tahminator or angelayu0530)

@tahminator
tahminator force-pushed the dependabot/cicd-05086d0457 branch from b909bb0 to f651e7a Compare October 19, 2026 18:01
@pat-agent

pat-agent Bot commented Oct 19, 2026

Copy link
Copy Markdown

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-leetcode-auth-stealer-service-arm/tags under the following tags:

  • codebloom-leetcode-auth-stealer-service-arm:staging-latest
  • codebloom-leetcode-auth-stealer-service-arm:staging-2026.10.19-14.02.44
  • codebloom-leetcode-auth-stealer-service-arm:staging-43aa8cc

@pat-agent

pat-agent Bot commented Oct 19, 2026

Copy link
Copy Markdown

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-standup-bot-arm/tags under the following tags:

  • codebloom-standup-bot-arm:staging-latest
  • codebloom-standup-bot-arm:staging-2026.10.19-14.02.43
  • codebloom-standup-bot-arm:staging-43aa8cc

@pat-agent

pat-agent Bot commented Oct 19, 2026

Copy link
Copy Markdown

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-standup-bot/tags under the following tags:

  • codebloom-standup-bot:staging-latest
  • codebloom-standup-bot:staging-2026.10.19-14.02.40
  • codebloom-standup-bot:staging-43aa8cc

@pat-agent

pat-agent Bot commented Oct 19, 2026

Copy link
Copy Markdown

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-leetcode-auth-stealer-service/tags under the following tags:

  • codebloom-leetcode-auth-stealer-service:staging-latest
  • codebloom-leetcode-auth-stealer-service:staging-2026.10.19-14.02.36
  • codebloom-leetcode-auth-stealer-service:staging-43aa8cc

@pat-agent

pat-agent Bot commented Oct 19, 2026

Copy link
Copy Markdown

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom/tags under the following tags:

  • codebloom:staging-latest
  • codebloom:staging-2026.10.19-14.29.11
  • codebloom:staging-43aa8cc

@dependabot @tahminator
deps(ci): bump the cicd group across 1 directory with 2 updates
8078225 
Bumps the cicd group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout) and [actions/github-script](https://github.com/actions/github-script).


Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v6...v7)

Updates `actions/github-script` from 8 to 9
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@v8...v9)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cicd
- dependency-name: actions/github-script
  dependency-version: '9'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: cicd
...

Signed-off-by: dependabot[bot] <support@github.com>
@tahminator
tahminator force-pushed the dependabot/cicd-05086d0457 branch from f651e7a to 8078225 Compare October 23, 2026 18:12
@coderabbitai

coderabbitai Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 06f5ea0c-d306-456c-aca5-4c1ade0ce3d3
📥 Commits

Reviewing files that changed from the base of the PR and between 8d5310c and 8078225.

📒 Files selected for processing: 5
  • .github/workflows/ci-cd.yml
  • .github/workflows/copy-command.yml
  • .github/workflows/e2e.yml
  • .github/workflows/help-command.yml
  • .github/workflows/migrate-command.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Changes

The workflows update checkout actions from v6 to v7. The copy and migrate workflows also update GitHub Script from v8 to v9. Other workflow behavior remains unchanged.

Workflow action updates

Layer / File(s) Summary
Update workflow action versions
.github/workflows/ci-cd.yml, .github/workflows/copy-command.yml, .github/workflows/e2e.yml, .github/workflows/help-command.yml, .github/workflows/migrate-command.yml		 Checkout steps now use actions/checkout@v7. The copy and migrate workflows now use actions/github-script@v9 to retrieve the PR head SHA.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Suggested reviewers: angelayu0530

Merge Risk: ⚪ Minimal · up to 80782

No change-induced issue remains that should block merging. Credential hardening in these workflows is worthwhile separately, but the update does not worsen that exposure.

Security architecture risk: 🔵 Low · up to 80782

The update preserves the configured permissions, PR selection, and deployment controls. Four retained security findings concern existing credential exposure, rather than a demonstrated regression from this update. Fork permission restrictions and manual-dispatch controls limit exposure, but effective repository settings and upstream runtime behavior remain partly unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — The retained checkout-token paths concern authority within the workflow repository. CI declares content, issue, pull-request, and check write permissions; help declares pull-request write permission. Fork pull_request tokens normally receive read-only permissions, so external contributors cannot uniformly be assumed to obtain those declared write grants. Repository-specific overrides were not established.

Security Findings and Attack Paths

  • inferred — Four retained findings describe PR-influenced code executing in jobs with persisted checkout credentials. The local configuration and documented checkout behavior show that this condition predates the PR; no increased credential authority or newly reachable execution path was demonstrated. Effective reachability remains conditional on PR origin, dispatch access, and repository settings.

Trust Boundaries and Controls

  • observed — The database-command jobs retain read-only contents and pull-request token grants, but also pass secrets into setup before executing PR-selected scripts. Their downstream authority therefore cannot be bounded solely by GITHUB_TOKEN permissions. Authorization uses a supplied username; binding that input to the authenticated dispatcher was not established. These relationships are unchanged by the version update.

Resilience and Maintainability Implications

  • observed — Copy and migration retain shared, non-canceling staging-database serialization. Copy performs destructive cleaning before a transactional restore and subsequent cleanup; failure-status reporting does not restore the preceding database state. Migration delegates execution to Flyway. Interruption recovery, database locking guarantees, and operational recovery ownership remain unverified, rather than established upgrade regressions.
Pre-merge checks: Passed 4 · Failed 1

Failed Failed checks: 1 warning

Check name Status Explanation Resolution
Description check Warning The description clearly explains the two dependency updates and includes release notes. It omits the required checklist and screenshots sections, does not report test results, and does not document st… Add the required sections from the repository template: Description of changes, Checklist before review, and Screenshots with Dev and Staging subsections. Complete the checklist, report test results, state whether staging deployment was com…
Passed Passed checks: 4 passed
Check name Status Explanation
Title check Passed The title identifies the CI dependency update, which matches the main change. It says 1 update, but the PR updates two actions: actions/checkout and actions/github-script.
Docstring Coverage Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (5 skipped: 5 unsupported.)

Full details: Description check

Explanation

The description clearly explains the two dependency updates and includes release notes. It omits the required checklist and screenshots sections, does not report test results, and does not document staging or manual QA.

Resolution

Add the required sections from the repository template: Description of changes, Checklist before review, and Screenshots with Dev and Staging subsections. Complete the checklist, report test results, state whether staging deployment was completed, and document manual QA or explain why it was not performed.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@pat-agent

pat-agent Bot commented Oct 23, 2026

Copy link
Copy Markdown

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-leetcode-auth-stealer-service/tags under the following tags:

  • codebloom-leetcode-auth-stealer-service:staging-latest
  • codebloom-leetcode-auth-stealer-service:staging-2026.10.23-14.13.13
  • codebloom-leetcode-auth-stealer-service:staging-d6d1b68

@pat-agent

pat-agent Bot commented Oct 23, 2026

Copy link
Copy Markdown

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-leetcode-auth-stealer-service-arm/tags under the following tags:

  • codebloom-leetcode-auth-stealer-service-arm:staging-latest
  • codebloom-leetcode-auth-stealer-service-arm:staging-2026.10.23-14.13.20
  • codebloom-leetcode-auth-stealer-service-arm:staging-d6d1b68

@sonarqubecloud

sonarqubecloud Bot commented Oct 23, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed for 'codebloom_frontend'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@pat-agent

pat-agent Bot commented Oct 23, 2026

Copy link
Copy Markdown

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-standup-bot-arm/tags under the following tags:

  • codebloom-standup-bot-arm:staging-latest
  • codebloom-standup-bot-arm:staging-2026.10.23-14.13.29
  • codebloom-standup-bot-arm:staging-d6d1b68

@sonarqubecloud

sonarqubecloud Bot commented Oct 23, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed for 'codebloom_backend'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@pat-agent

pat-agent Bot commented Oct 23, 2026

Copy link
Copy Markdown

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-standup-bot/tags under the following tags:

  • codebloom-standup-bot:staging-latest
  • codebloom-standup-bot:staging-2026.10.23-14.13.21
  • codebloom-standup-bot:staging-d6d1b68

@pat-agent

pat-agent Bot commented Oct 23, 2026

Copy link
Copy Markdown

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom-arm/tags under the following tags:

  • codebloom-arm:staging-latest
  • codebloom-arm:staging-2026.10.23-14.16.57
  • codebloom-arm:staging-d6d1b68

@pat-agent

pat-agent Bot commented Oct 23, 2026

Copy link
Copy Markdown

The image has been uploaded to https://hub.docker.com/r/patinanetwork/codebloom/tags under the following tags:

  • codebloom:staging-latest
  • codebloom:staging-2026.10.23-14.17.06
  • codebloom:staging-d6d1b68

@tahminator
tahminator merged commit f0825de into main Oct 23, 2026
23 checks passed
@tahminator
tahminator deleted the dependabot/cicd-05086d0457 branch October 23, 2026 18:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tahminator tahminator tahminator approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tahminator