Skip to content

chore(deps): update github workflows #6733

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore(deps): update github workflows #6733

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/ai-integration-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,17 +19,17 @@ jobs:

steps:
- name: Setup Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
Comment thread
cursor[bot] marked this conversation as resolved.
with:
python-version: 3.14t

- name: Setup Node.js
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
Comment thread
sentry-warden[bot] marked this conversation as resolved.
node-version: '20'
node-version: '24'

- name: Checkout repo
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
token: ${{ secrets.GITHUB_TOKEN }}

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/changelog-preview.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,6 @@ permissions:

jobs:
changelog-preview:
uses: getsentry/craft/.github/workflows/changelog-preview.yml@6143e76379c342e247687c4ab5c83d8b900cc273 # v2
uses: getsentry/craft/.github/workflows/changelog-preview.yml@aeb16753a1764f3ef0768c03c499e3d2e4b7227c # v2
secrets:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
12 changes: 6 additions & 6 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,9 @@ jobs:
timeout-minutes: 10

steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
Comment thread
sentry-warden[bot] marked this conversation as resolved.
with:
python-version: 3.14

Expand All @@ -46,9 +46,9 @@ jobs:
timeout-minutes: 10

steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
python-version: 3.14
- name: Build Packages
Expand All @@ -71,9 +71,9 @@ jobs:
timeout-minutes: 10

steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
python-version: 3.14

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/enforce-license-compliance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,6 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: 'Enforce License Compliance'
uses: getsentry/action-enforce-license-compliance@48236a773346cb6552a7bda1ee370d2797365d87 # main
uses: getsentry/action-enforce-license-compliance@d0aa91b82375e45135e96c02f17ce3b8002867cd # main
with:
fossa_api_key: ${{ secrets.FOSSA_API_KEY }}
4 changes: 2 additions & 2 deletions .github/workflows/flaky-test-detector.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@
environment: AI Integrations Tests

Comment thread
sentry-warden[bot] marked this conversation as resolved.
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

# --- Step A: deterministic collection of UNTRUSTED CI logs -----------
# Runs with the read-only GITHUB_TOKEN. No LLM here. Writes failure logs
Expand Down Expand Up @@ -108,10 +108,10 @@
# and the repo, and writes the issue body to flaky-issue-body.md.
- name: Analyze logs and summarize flaky tests
if: steps.collect.outputs.collected != '0'
uses: anthropics/claude-code-action@11ba60486e4aec9ddfeafcf4bb3f00b028ac2c16 # v1.0.142
uses: anthropics/claude-code-action@9db594c7a0e82298c121c18b7f08aa1579ce7341 # v1.0.185
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
github_token: ${{ github.token }}

Check warning on line 114 in .github/workflows/flaky-test-detector.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

Analysis step receives write-capable GitHub token despite claims of no write credential 

The step passes `github_token: ${{ github.token }}` even though the security comment claims it runs with "NO write credential". The workflow-level `permissions` block grants `issues: write` to this token, so a compromised third-party action could create issues or modify repository state, contrary to the documented security boundary.
Comment on lines +111 to 114

@sentry-warden sentry-warden Bot Aug 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Analysis step receives write-capable GitHub token despite claims of no write credential

The step passes github_token: ${{ github.token }} even though the security comment claims it runs with "NO write credential". The workflow-level permissions block grants issues: write to this token, so a compromised third-party action could create issues or modify repository state, contrary to the documented security boundary.

Evidence
  • The workflow-level permissions block at the top of the file grants issues: write.
  • Line 114 passes github_token: ${{ github.token }} to the anthropics/claude-code-action.
  • The context before the hunk includes the comment at line 103 claiming the analysis step has "NO write credential".
  • This means the security boundary described in the file header (keeping untrusted logs away from credentialed write channels) is weaker than claimed, because the action receives a token with issues: write enabled.

Identified by Warden · find-bugs · EXH-P6R

claude_args: |
--max-turns 40
--model opus
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,12 +26,12 @@ jobs:
with:
app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
token: ${{ steps.token.outputs.token }}
fetch-depth: 0
- name: Prepare release
uses: getsentry/craft@6143e76379c342e247687c4ab5c83d8b900cc273 # v2.26.9
uses: getsentry/craft@aeb16753a1764f3ef0768c03c499e3d2e4b7227c # 2.28.0
env:
GITHUB_TOKEN: ${{ steps.token.outputs.token }}
with:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-agents.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-ai-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

Check failure on line 27 in .github/workflows/test-integrations-ai-workflow.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

actions/checkout pinned with non-existent release v7.0.1 

The `# v7.0.1` comment does not match any official release of the `actions/checkout` action, making the SHA impossible to verify and creating supply chain risk.
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0

Check failure on line 29 in .github/workflows/test-integrations-ai-workflow.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

[GY2-PLQ] actions/checkout pinned with non-existent release v7.0.1 (additional location) 

The `# v7.0.1` comment does not match any official release of the `actions/checkout` action, making the SHA impossible to verify and creating supply chain risk.
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-ai.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-cloud.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
Comment thread
sentry-warden[bot] marked this conversation as resolved.
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-common.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test-integrations-dbs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
os: [ubuntu-22.04]
services:
postgres:
image: ghcr.io/getsentry/image-mirror-library-postgres:17-alpine
image: ghcr.io/getsentry/image-mirror-library-postgres:18-alpine

Check failure on line 24 in .github/workflows/test-integrations-dbs.yml

View check run for this annotation

@sentry/warden / warden: code-review

PostgreSQL service image bumped to unavailable major version 

The postgres service image changed from `17-alpine` to `18-alpine`, but PostgreSQL 18 has not been released yet. The missing image tag will cause workflow runs to fail during container initialization.
Comment thread
sentry-warden[bot] marked this conversation as resolved.
env:
POSTGRES_PASSWORD: sentry
# Set health checks to wait until postgres has started
Expand Down Expand Up @@ -54,9 +54,9 @@
SENTRY_PYTHON_TEST_MYSQL_PASSWORD: sentry
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
Comment thread
sentry-warden[bot] marked this conversation as resolved.
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: "Setup ClickHouse Server"
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-flags.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,11 +22,11 @@
env:
# 3.6/3.7 run in the python:X.Y container; tell uv to use that system Python.
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}

Check failure on line 25 in .github/workflows/test-integrations-flags.yml

View check run for this annotation

@sentry/warden / warden: skill-scanner

CI workflow references non-existent actions/checkout version 

The workflow pins actions/checkout to a SHA annotated as v7.0.1, a version that does not exist in the official repository, indicating a potential supply chain compromise or unverified action update.
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

Check failure on line 27 in .github/workflows/test-integrations-flags.yml

View check run for this annotation

@sentry/warden / warden: skill-scanner

[WDD-R6U] CI workflow references non-existent actions/checkout version (additional location) 

The workflow pins actions/checkout to a SHA annotated as v7.0.1, a version that does not exist in the official repository, indicating a potential supply chain compromise or unverified action update.
Comment thread
sentry-warden[bot] marked this conversation as resolved.
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-gevent.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-graphql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-mcp.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

Check failure on line 27 in .github/workflows/test-integrations-mcp.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

[GY2-PLQ] actions/checkout pinned with non-existent release v7.0.1 (additional location) 

The `# v7.0.1` comment does not match any official release of the `actions/checkout` action, making the SHA impossible to verify and creating supply chain risk.
Comment thread
sentry-warden[bot] marked this conversation as resolved.
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-misc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-network.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
Comment thread
sentry-warden[bot] marked this conversation as resolved.
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test-integrations-tasks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,13 +35,13 @@ jobs:
SENTRY_PYTHON_TEST_REDIS_HOST: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'redis' || 'localhost' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Install Java
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5

@cursor cursor Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Invalid setup-java action digest

High Severity

The pinned actions/setup-java digest b6effb05e454b25005698d916606bdc6ffcbf961 does not match the digest this PR documents (03ad4de0992f5dab5e18fcb136590ce7c4a0ac95) and does not resolve to a known commit on actions/setup-java. Jobs that install Java via this pin, including the tasks integration workflow, will fail when GitHub Actions cannot fetch the action.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit b59bcb4. Configure here.

with:
distribution: 'temurin'
java-version: '21'
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test-integrations-web-1.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
os: [ubuntu-22.04]
services:
postgres:
image: ghcr.io/getsentry/image-mirror-library-postgres:17-alpine
image: ghcr.io/getsentry/image-mirror-library-postgres:18-alpine

Check failure on line 24 in .github/workflows/test-integrations-web-1.yml

View check run for this annotation

@sentry/warden / warden: code-review

[WPS-2TT] PostgreSQL service image bumped to unavailable major version (additional location) 

The postgres service image changed from `17-alpine` to `18-alpine`, but PostgreSQL 18 has not been released yet. The missing image tag will cause workflow runs to fail during container initialization.
Comment thread
sentry-warden[bot] marked this conversation as resolved.
env:
POSTGRES_PASSWORD: sentry
# Set health checks to wait until postgres has started
Expand All @@ -41,9 +41,9 @@
SENTRY_PYTHON_TEST_POSTGRES_PASSWORD: sentry
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-web-2.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,9 +98,9 @@ jobs:
if: ${{ !cancelled() }}
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
- name: Download coverage data
# Artifacts from the reusable test workflows live in this same run.
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
Expand All @@ -115,7 +115,7 @@ jobs:
uv run coverage combine .coverage-sentry-*
uv run coverage xml
- name: Report coverage and test results
uses: getsentry/codecov-action@d90e69cdf071dfbb0430159125321dc09c424d4c # main
uses: getsentry/codecov-action@66554aa51d8656c657e233a9e98bcb18e95f2c9a # main
Comment thread
sentry-warden[bot] marked this conversation as resolved.
with:
token: ${{ secrets.GITHUB_TOKEN }}
files: coverage.xml
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/update-tox.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,12 @@ jobs:

steps:
- name: Checkout repo
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
token: ${{ secrets.GITHUB_TOKEN }}

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
cache-python: true

Comment thread
sentry-warden[bot] marked this conversation as resolved.
Expand Down
8 changes: 4 additions & 4 deletions scripts/split_tox_gh_actions/templates/test_group.jinja
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
{% endif %}
{% if needs_postgres %}
postgres:
image: ghcr.io/getsentry/image-mirror-library-postgres:17-alpine
image: ghcr.io/getsentry/image-mirror-library-postgres:18-alpine

Check warning on line 20 in scripts/split_tox_gh_actions/templates/test_group.jinja

View check run for this annotation

@sentry/warden / warden: find-bugs

PostgreSQL 18 image does not exist, causing CI workflow failures 

The postgres service image was bumped to `18-alpine`, but PostgreSQL 18 has not been released yet and this mirrored image tag does not exist, causing CI jobs to fail on pull.

@sentry-warden sentry-warden Bot Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Undocumented Postgres major version bump likely breaks CI

PostgreSQL 18-alpine image does not appear to exist as a stable release, and this change is not mentioned in the PR description which only claims to update GitHub Actions.

Evidence
  • The PR title and body explicitly list only GitHub Action updates (actions/checkout, actions/setup-java, actions/setup-node, etc.) with no mention of a PostgreSQL version change.
  • PostgreSQL 17 is the current latest stable major version; PostgreSQL 18 has not been released, so the Docker tag 18-alpine almost certainly does not exist on ghcr.io/getsentry/image-mirror-library-postgres.
  • scripts/split_tox_gh_actions/templates/test_group.jinja line 20 hardcodes ghcr.io/getsentry/image-mirror-library-postgres:18-alpine; this template is included by base.jinja, so the tag is expanded into the generated workflow files test-integrations-dbs.yml and test-integrations-web-1.yml (the groups containing asyncpg and django), causing CI service container startup failures across those workflows.
  • Updating a database major version in test infrastructure is a significant compatibility risk that should be reviewed separately, not bundled silently into an unrelated Actions update PR.

Identified by Warden · code-review, find-bugs · U2R-5DG

env:
POSTGRES_PASSWORD: sentry
Comment thread
sentry-warden[bot] marked this conversation as resolved.
# Set health checks to wait until postgres has started
Expand Down Expand Up @@ -72,9 +72,9 @@
{% endif %}
container: {% raw %}${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}{% endraw %}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
Comment thread
sentry-warden[bot] marked this conversation as resolved.
enable-cache: false

Expand All @@ -85,7 +85,7 @@

{% if needs_java %}
- name: Install Java
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
with:
distribution: 'temurin'
java-version: '21'
Expand Down
Loading
Loading