chore(deps): update github actions - #200
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
6332854 to
309fb0a
Compare
309fb0a to
437f524
Compare
57c9a54 to
c0fbd5a
Compare
a0a3efc to
e5e87f7
Compare
![ferrfleet[bot]](https://avatars.githubusercontent.com/in/4354888?s=60&v=4){kind=small}
There was a problem hiding this comment.
Uneventful. This only touches .github/workflows/* — digest bumps for the FerrLabs reusable-workflow pins, docker/login-action, and github/codeql-action, plus ossf/scorecard-action v2.4.3→v2.4.4 (patch: logs Scorecard POST failures instead of failing the job — strictly safer) and FerrLabs/FerrFlow v5.46.0→v5.48.1 (bug fixes only: cosign-sign release artifacts, push tags before forge release, bump gix crate — no API/input changes, mode: publish usage in publish.yml is unaffected). No breaking changes upstream that touch this repo's usage.
CI: all completed checks are green (Security, Detect Go module, Conventional commits, secrets/CVE/SAST scans); a few jobs (Lint, Test, kind smoke test, opengrep) were still running at review time with no failures so far. The "blocked" mergeable state is just Renovate's stability-days check waiting out the minimum release age, not a CI failure.
No blocking or nit findings.
e5e87f7 to
003c9b3
Compare
There was a problem hiding this comment.
Follow-up (new commit since last review). The branch got rebased/updated: the FerrLabs reusable-workflow pin used by ci.yml/release.yml/renovate-rebase.yml/sbom-track.yml/security-scan.yml moved further, from b44400b3 to 05e39b3f on FerrLabs/.github@main.
What's new in that range that touches this repo: reusable-security-scan.yml now runs a FerrLabs-authored OpenGrep ruleset by default (ferrlabs-rules: true, org-audit rules) alongside the community ruleset. This is soft-fail only — fail-on-sast still defaults to false and FerrVault's security-scan.yml doesn't override it — so at most it adds warning annotations to the Security tab, it cannot fail CI. The rest of the range (runner-group routing docs, a Renovate cargo-registry config change for ferrlabs-* crates) doesn't affect this repo (Go, not Rust).
docker/login-action, github/codeql-action, ossf/scorecard-action (v2.4.4, safer error-logging patch), and FerrLabs/FerrFlow (v5.48.1, bug fixes only) pins are unchanged from what was already reviewed — still no breaking changes reaching this repo's usage.
CI: all completed checks are green; Lint/Test/kind-smoke-test/opengrep were still in progress at review time with nothing failing so far. Still blocked only on Renovate's stability-days minimum-release-age gate, not a CI failure.
No blocking or nit findings.
5a5c295 to
d8bc223
Compare
There was a problem hiding this comment.
Follow-up (new commit since last review). Since 003c9b33, two things moved:
- FerrLabs/.github reusable-workflow pin (
05e39b3f→51ff973e, used by ci.yml/release.yml/renovate-rebase.yml/sbom-track.yml/security-scan.yml). The new commit isrevert(ci): rétablit le ciblage des runners par nom (#194)— it revertsruns-onfrom'group=ferrlabs-k8s'back to'ferrlabs-k8s'(nogroup=prefix) across every reusable workflow, including the ones this repo consumes. Empirically harmless here:Detect Go module,gitleaks,osv-scanner,zizmor,snyk,Conventional commitson this exact commit already completed successfully, and Lint/Test/Security/kind-smoke-test are running without failure — the runner-targeting revert isn't breaking anything in this repo. - FerrLabs/FerrFlow v5.48.1→v5.49.0:
feat(migrate): auto-discover workspace packages for changesets. This isferrflow migrateonly;publish.ymlusesmode: publish, so it's unaffected.
CI: only outstanding status is renovate/stability-days (minimum release age), same as before — not a CI failure.
No blocking or nit findings.
d8bc223 to
966d012
Compare
| ci: | ||
| name: CI | ||
| uses: FerrLabs/.github/.github/workflows/reusable-ci-go.yml@4215a840974a9eb611b05f1496ec99d7ba0492c0 # main | ||
| uses: FerrLabs/.github/.github/workflows/reusable-ci-go.yml@d3ce80b43af8b567b503ab4c3ee44d6e33c246f5 # main |
| jobs: | ||
| dispatch: | ||
| uses: FerrLabs/.github/.github/workflows/reusable-renovate-dispatch.yml@a4b4a70d116127cd49f09ad6f363ac55fd8f6501 # main | ||
| uses: FerrLabs/.github/.github/workflows/reusable-renovate-dispatch.yml@d3ce80b43af8b567b503ab4c3ee44d6e33c246f5 # main |
| sbom: | ||
| name: SBOM → Dependency-Track | ||
| uses: FerrLabs/.github/.github/workflows/reusable-sbom-track.yml@4215a840974a9eb611b05f1496ec99d7ba0492c0 # main | ||
| uses: FerrLabs/.github/.github/workflows/reusable-sbom-track.yml@d3ce80b43af8b567b503ab4c3ee44d6e33c246f5 # main |
| scan: | ||
| name: Secrets + CVE | ||
| uses: FerrLabs/.github/.github/workflows/reusable-security-scan.yml@4215a840974a9eb611b05f1496ec99d7ba0492c0 # main | ||
| uses: FerrLabs/.github/.github/workflows/reusable-security-scan.yml@d3ce80b43af8b567b503ab4c3ee44d6e33c246f5 # main |
966d012 to
9d6103a
Compare
1 participant
This PR contains the following updates:
4215a84→d3ce80bv5.46.0→v5.49.0abd2ef4→dbcb813e4fba86→f205ea1v2.4.3→v2.4.4Release Notes
FerrLabs/FerrFlow (FerrLabs/FerrFlow)
v5.49.0Compare Source
[5.49.0] - 2026-07-28
Features
Performance
Binary
Note: every competitor is a Node.js package — none ship a native binary, so this section can only show
ferrflow. Cross-tool comparisons live in the Npm section.Docker
Note: no competitor publishes a first-party Docker image that is comparable to
ghcr.io/ferrlabs/ferrflow(a single static binary). Wrapping the Node tools innode:ltswould only re-timenode startup + npm + the toolalready measured in the Npm section, so this section is intentionally limited toferrflow.Npm
Install footprint
v5.48.1Compare Source
[5.48.1] - 2026-07-28
Bug Fixes
Performance
Binary
Note: every competitor is a Node.js package — none ship a native binary, so this section can only show
ferrflow. Cross-tool comparisons live in the Npm section.Docker
Note: no competitor publishes a first-party Docker image that is comparable to
ghcr.io/ferrlabs/ferrflow(a single static binary). Wrapping the Node tools innode:ltswould only re-timenode startup + npm + the toolalready measured in the Npm section, so this section is intentionally limited toferrflow.Npm
Install footprint
v5.48.0Compare Source
v5.47.4Compare Source
[5.47.4] - 2026-07-27
Bug Fixes
Performance
Binary
Note: every competitor is a Node.js package — none ship a native binary, so this section can only show
ferrflow. Cross-tool comparisons live in the Npm section.Docker
Note: no competitor publishes a first-party Docker image that is comparable to
ghcr.io/ferrlabs/ferrflow(a single static binary). Wrapping the Node tools innode:ltswould only re-timenode startup + npm + the toolalready measured in the Npm section, so this section is intentionally limited toferrflow.Npm
Install footprint
v5.47.3Compare Source
[5.47.3] - 2026-07-25
Bug Fixes
Performance
Binary
Note: every competitor is a Node.js package — none ship a native binary, so this section can only show
ferrflow. Cross-tool comparisons live in the Npm section.Docker
Note: no competitor publishes a first-party Docker image that is comparable to
ghcr.io/ferrlabs/ferrflow(a single static binary). Wrapping the Node tools innode:ltswould only re-timenode startup + npm + the toolalready measured in the Npm section, so this section is intentionally limited toferrflow.Npm
Install footprint
v5.47.2Compare Source
[5.47.2] - 2026-07-25
Bug Fixes
Performance
Binary
Note: every competitor is a Node.js package — none ship a native binary, so this section can only show
ferrflow. Cross-tool comparisons live in the Npm section.Docker
Note: no competitor publishes a first-party Docker image that is comparable to
ghcr.io/ferrlabs/ferrflow(a single static binary). Wrapping the Node tools innode:ltswould only re-timenode startup + npm + the toolalready measured in the Npm section, so this section is intentionally limited toferrflow.Npm
Install footprint
v5.47.1Compare Source
[5.47.1] - 2026-07-23
Bug Fixes
Performance
Binary
Note: every competitor is a Node.js package — none ship a native binary, so this section can only show
ferrflow. Cross-tool comparisons live in the Npm section.Docker
Note: no competitor publishes a first-party Docker image that is comparable to
ghcr.io/ferrlabs/ferrflow(a single static binary). Wrapping the Node tools innode:ltswould only re-timenode startup + npm + the toolalready measured in the Npm section, so this section is intentionally limited toferrflow.Npm
Install footprint
v5.47.0Compare Source
[5.47.0] - 2026-07-21
Features
Performance
Binary
Note: every competitor is a Node.js package — none ship a native binary, so this section can only show
ferrflow. Cross-tool comparisons live in the Npm section.Docker
Note: no competitor publishes a first-party Docker image that is comparable to
ghcr.io/ferrlabs/ferrflow(a single static binary). Wrapping the Node tools innode:ltswould only re-timenode startup + npm + the toolalready measured in the Npm section, so this section is intentionally limited toferrflow.Npm
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.