Skip to content

chore(deps): bump the github-actions group across 1 directory with 10 updates#1567

Merged
jescalada merged 2 commits into
mainfrom
dependabot/github_actions/github-actions-ee4cbb3667
Jun 7, 2026
Merged

chore(deps): bump the github-actions group across 1 directory with 10 updates#1567
jescalada merged 2 commits into
mainfrom
dependabot/github_actions/github-actions-ee4cbb3667

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 6, 2026

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 10 updates in the / directory:

Package From To
step-security/harden-runner 2.19.3 2.19.4
actions/checkout 6.0.2 6.0.3
codecov/codecov-action 5.5.4 6.0.1
cypress-io/github-action 7.3.0 7.4.0
actions/dependency-review-action 4.8.2 5.0.0
docker/setup-buildx-action 4.0.0 4.1.0
docker/login-action 4.1.0 4.2.0
crazy-max/ghaction-github-runtime 3.1.0 4.0.0
docker/setup-compose-action e29e0ecd235838be5f2e823f8f512a72dc55f662 dd8b913e8081779e7a75dd4ffd066e6ba62a289c
release-drafter/release-drafter 7.3.0 7.3.1

Updates step-security/harden-runner from 2.19.3 to 2.19.4

Release notes

Sourced from step-security/harden-runner's releases.

v2.19.4

What's Changed

  • Improvements for HTTPS Monitoring for the Enterprise tier of Harden Runner

Full Changelog: step-security/harden-runner@v2.19.3...v2.19.4

Commits

Updates actions/checkout from 6.0.2 to 6.0.3

Release notes

Sourced from actions/checkout's releases.

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

... (truncated)

Commits

Updates codecov/codecov-action from 5.5.4 to 6.0.1

Release notes

Sourced from codecov/codecov-action's releases.

v6.0.1

What's Changed

Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1

v6.0.0

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

Full Changelog: codecov/codecov-action@v5.5.4...v6.0.0

Changelog

Sourced from codecov/codecov-action's changelog.

v5.5.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2

v5.5.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

v5.4.3

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

... (truncated)

Commits

Updates cypress-io/github-action from 7.3.0 to 7.4.0

Release notes

Sourced from cypress-io/github-action's releases.

v7.4.0

7.4.0 (2026-06-01)

Features

Changelog

Sourced from cypress-io/github-action's changelog.

Changelog

This document gives an overview of changes to the Cypress GitHub JavaScript Action cypress-io/github-action.

See Releases for full details of changes.

Version Changes
v7.4.0 Examples remove Node.js 25. End of support for Node.js 25.
v7.3.0 Add parameter expose for Cypress.expose() support
v7.2.0 Examples remove Node.js 20. End of support for Node.js 20.
v7.1.0 Add parameter package-manager-cache
v7.0.0 Action runs under Node.js 24 instead of Node.js 20
v6.10.0 Examples remove Node.js 23. End of support for Node.js 23.
v6.9.0 Add parameter validation for command
v6.8.0 Examples remove Node.js 18. End of support for Node.js 18.
v6.7.10 Examples updated to Cypress 14
v6.7.9 Migrate to @actions/cache@4.0.0 for continued access to GitHub Actions caching services
v6.7.0 Examples remove Node.js 21. End of support for Node.js 21.
v6.6.0 Add parameter summary-title
v6.5.0 Examples remove Node.js 16. End of support for Node.js 16.
v6.4.0 Action adds PR number and URL if available when recording
v6.3.0 v6 is recommended action version
v6.2.0 Examples updated to Cypress 13
v6.1.0 Examples for Cypress 9 archived in action's v5 branch
v6.0.0 Action runs under Node.js 20 instead of Node.js 16
v5.8.1 Examples remove Node.js 19. End of support for Node.js 19
v5.8.0 Add GitHub step output resultsUrl. Deprecate dashboardUrl.
v5.7.0 Add basic Yarn Modern Plug'n'Play support
v5.6.2 Examples add Node.js 20. End of support and removal of Node.js 14 examples.
v5.6.0 Add check for lockfile presence
v5.5.0 Examples add Yarn Modern
v5.4.0 Examples add Yarn Classic
v5.3.0 Add parameter publish-summary (default true)
v5.2.0 Examples add Node.js 19
v5.1.0 Add parameter auto-cancel-after-failures
v5.0.0 Examples add Node.js 18 and remove Node.js 12
v4.2.2 Dependency on GitHub set-output workflow command removed
v4.2.0 Support for pnpm added
v4.0.0 Support for Cypress 10 and later versions added
v3 Action runs under Node.js 16 instead of Node.js 12
v2 Cypress runs using the Module API
v1 This version is no longer runnable in GitHub due to security changes.
Commits
  • 948d67d feat(deps): remove Node.js 25 (#1781)
  • 2b7e08a chore(deps): update dependency node to v24.16.0 (#1777)
  • 69a0c7c test: complete cypress@15.16.0 update (#1778)
  • e487d96 chore(deps): update node.js to v24.16.0 (#1770)
  • 5cfba34 chore(deps): update dependency webpack to ^5.107.0 (#1771)
  • 65ccb9f chore: add minimum release age and vulnerability alerts to renovate config (#...
  • 5130fef chore(deps): update dependency cypress to v15.16.0 (#1773)
  • e910707 test: exclude Cypress from Yarn Modern npmMinimalAgeGate (#1774)
  • 984bd80 chore(deps): update yarn to v4.15.0 (#1768)
  • 1c3bb66 chore(deps): update dependency vite to ^8.0.14 (#1769)
  • Additional commits viewable in compare view

Updates actions/dependency-review-action from 4.8.2 to 5.0.0

Release notes

Sourced from actions/dependency-review-action's releases.

5.0.0

This is a new major version of the Dependency Review Action which updates the runtime to node24. This requires a minimum Actions Runner version v2.327.1 to run.

What's Changed

New Contributors

Full Changelog: actions/dependency-review-action@v4.9.0...v5.0.0

Dependency Review Action 4.9.0

This feature release contains a couple of notable changes:

  • There is a new configuration option show_patched_versions which will add a column to the output, showing the fix version of each vulnerable dependency. Thanks @​felickz!
  • Runs which do not display OpenSSF scorecards no longer fetch scorecard information; previously it was fetched regardless of whether or not it was displayed, causing unneccessary slowness. Great catch @​jantiebot!
  • There are a couple of fixes to purl parsing which should improve match accuracy for allow-package-dependency lists, including case (in)sensitivity and url-encoded namespaces Thanks @​juxtin!

What's Changed

New Contributors

Full Changelog: actions/dependency-review-action@v4.8.3...v4.9.0

4.8.3

Dependency Review Action v4.8.3

This is a bugfix release that updates a number of upstream dependencies and includes a fix for the earlier feature that detected oversized summaries and upload them as artifacts, which could occasionally crash the action.

We have also updated the release process to use a long-lived v4 branch for the action, instead of a force-pushed tag, which aligns better with git branching strategies; the change should be transparent to end users.

What's Changed

... (truncated)

Commits
  • a1d282b Merge pull request #1098 from actions/ahpook/v5-release
  • eb6c199 update examples to show @​v5
  • 3943c2c v5.0.0 release branch
  • 454943c Merge pull request #1094 from actions/ashelytc/security-findings
  • 6d92a12 revert @​typescript-eslint/parser update
  • a8e5a7e Merge pull request #1076 from tspascoal/fix-version-matching-for-non-string-s...
  • b6b7079 update @​typescript-eslint/parser to 8.40.0
  • 821a21d update more dependencies
  • 05aaaae run npm audit fix
  • 55d3e75 Merge pull request #1077 from Marukome0743/docs/checkout
  • Additional commits viewable in compare view

Updates docker/setup-buildx-action from 4.0.0 to 4.1.0

Release notes

Sourced from docker/setup-buildx-action's releases.

v4.1.0

Full Changelog: docker/setup-buildx-action@v4.0.0...v4.1.0

Commits

Updates docker/login-action from 4.1.0 to 4.2.0

Release notes

Sourced from docker/login-action's releases.

v4.2.0

Full Changelog: docker/login-action@v4.1.0...v4.2.0

Commits
  • 650006c Merge pull request #960 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
  • 99df1a3 chore: update generated content
  • 3ab375f build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
  • 39d8580 Merge pull request #970 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • 4eefcd3 chore: update generated content
  • 56d092c build(deps): bump @​docker/actions-toolkit from 0.86.0 to 0.90.0
  • e2e31ca Merge pull request #976 from docker/dependabot/npm_and_yarn/actions/core-3.0.1
  • 0bced94 chore: update generated content
  • 3e75a0f build(deps): bump @​actions/core from 3.0.0 to 3.0.1
  • 365bebd Merge pull request #984 from docker/dependabot/github_actions/aws-actions/con...
  • Additional commits viewable in compare view

Updates crazy-max/ghaction-github-runtime from 3.1.0 to 4.0.0

Release notes

Sourced from crazy-max/ghaction-github-runtime's releases.

v4.0.0

Full Changelog: crazy-max/ghaction-github-runtime@v3.1.0...v4.0.0

Commits
  • 04d248b Merge pull request #76 from crazy-max/node24
  • c8f8e4e node 24 as default runtime
  • 494a382 Merge pull request #68 from crazy-max/dependabot/npm_and_yarn/actions/core-2.0.1
  • 5d51b8e Merge pull request #74 from crazy-max/dependabot/npm_and_yarn/minimatch-3.1.5
  • f7077dc chore: update generated content
  • 4d1e035 chore(deps): bump minimatch from 3.1.2 to 3.1.5
  • b59d56d chore(deps): bump @​actions/core from 1.11.1 to 2.0.1
  • 6d0e2ef Merge pull request #75 from crazy-max/esm
  • 41d6f6a remove codecov config
  • b5018ec chore: update generated content
  • Additional commits viewable in compare view

Updates docker/setup-compose-action from e29e0ecd235838be5f2e823f8f512a72dc55f662 to dd8b913e8081779e7a75dd4ffd066e6ba62a289c

Commits
  • dd8b913 Merge pull request #101 from crazy-max/yarn-update
  • 168cd6c update yarn to 4.15.0
  • 410c00e Merge pull request #100 from docker/dependabot/npm_and_yarn/actions/core-3.0.1
  • 5d29e18 Merge pull request #99 from docker/sec-cli/ignore-scripts-fix-20260527-193420
  • 70b1359 chore: update generated content
  • f0bcefd chore(deps): bump @​actions/core from 3.0.0 to 3.0.1
  • 41e3c79 ci: enforce ignore-scripts policy for Node package managers
  • 16feee7 Merge pull request #55 from docker/dependabot/npm_and_yarn/docker/actions-too...
  • 739694b chore: update generated content
  • ae3c688 chore(deps): bump @​docker/actions-toolkit from 0.79.0 to 0.91.0
  • Additional commits viewable in compare view

Updates release-drafter/release-drafter from 7.3.0 to 7.3.1

Release notes

Sourced from release-drafter/release-drafter's releases.

v7.3.1

What's Changed

Bug Fixes

Maintenance

Dependency Updates

Full Changelog: release-drafter/release-drafter@v7.3.0...v7.3.1

Commits
  • 693d20e chore: release v7.3.1
  • 8339e41 docs: update contributing docs for release process
  • 62d8da4 fix: output name and tag_name in dry-run mode (#1625)
  • 2c6d395 chore(deps): update node.js to v24.15.0 (#1616)
  • 3b62240 chore(deps): update vite to v8.0.13 and vitest to v4.1.6 (#1624)
  • 446e151 fix(deps): adapt to graphql-codegen 7 type changes
  • 4cd06dc chore(deps): update graphql-codegen to 7.0.0
  • 8045768 fix(deps): update dependency semver to 7.8.0
  • 1cf836b ci(release): use local action for publish step
  • 485c120 chore(deps): update npm tool constraint to 11.14.1
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the github-actions group across 1 directory with 10…
1f0966a 
… updates

Bumps the github-actions group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [step-security/harden-runner](https://github.com/step-security/harden-runner) | `2.19.3` | `2.19.4` |
| [actions/checkout](https://github.com/actions/checkout) | `6.0.2` | `6.0.3` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.5.4` | `6.0.1` |
| [cypress-io/github-action](https://github.com/cypress-io/github-action) | `7.3.0` | `7.4.0` |
| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.8.2` | `5.0.0` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.0.0` | `4.1.0` |
| [docker/login-action](https://github.com/docker/login-action) | `4.1.0` | `4.2.0` |
| [crazy-max/ghaction-github-runtime](https://github.com/crazy-max/ghaction-github-runtime) | `3.1.0` | `4.0.0` |
| [docker/setup-compose-action](https://github.com/docker/setup-compose-action) | `e29e0ecd235838be5f2e823f8f512a72dc55f662` | `dd8b913e8081779e7a75dd4ffd066e6ba62a289c` |
| [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) | `7.3.0` | `7.3.1` |



Updates `step-security/harden-runner` from 2.19.3 to 2.19.4
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](step-security/harden-runner@v2.19.3...9af89fc)

Updates `actions/checkout` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@de0fac2...df4cb1c)

Updates `codecov/codecov-action` from 5.5.4 to 6.0.1
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@75cd116...e79a696)

Updates `cypress-io/github-action` from 7.3.0 to 7.4.0
- [Release notes](https://github.com/cypress-io/github-action/releases)
- [Changelog](https://github.com/cypress-io/github-action/blob/master/CHANGELOG.md)
- [Commits](cypress-io/github-action@dace029...948d67d)

Updates `actions/dependency-review-action` from 4.8.2 to 5.0.0
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@3c4e3dc...a1d282b)

Updates `docker/setup-buildx-action` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](docker/setup-buildx-action@v4...v4.1.0)

Updates `docker/login-action` from 4.1.0 to 4.2.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](docker/login-action@4907a6d...650006c)

Updates `crazy-max/ghaction-github-runtime` from 3.1.0 to 4.0.0
- [Release notes](https://github.com/crazy-max/ghaction-github-runtime/releases)
- [Commits](crazy-max/ghaction-github-runtime@3cb05d8...04d248b)

Updates `docker/setup-compose-action` from e29e0ecd235838be5f2e823f8f512a72dc55f662 to dd8b913e8081779e7a75dd4ffd066e6ba62a289c
- [Release notes](https://github.com/docker/setup-compose-action/releases)
- [Commits](docker/setup-compose-action@e29e0ec...dd8b913)

Updates `release-drafter/release-drafter` from 7.3.0 to 7.3.1
- [Release notes](https://github.com/release-drafter/release-drafter/releases)
- [Commits](release-drafter/release-drafter@c2e2804...693d20e)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-version: 2.19.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: codecov/codecov-action
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: cypress-io/github-action
  dependency-version: 7.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/dependency-review-action
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: docker/login-action
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: crazy-max/ghaction-github-runtime
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: docker/setup-compose-action
  dependency-version: dd8b913e8081779e7a75dd4ffd066e6ba62a289c
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: release-drafter/release-drafter
  dependency-version: 7.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 6, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 6, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot requested a review from a team as a code owner June 6, 2026 09:17
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 6, 2026
@netlify

netlify Bot commented Jun 6, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Name Link
🔨 Latest commit bffe243
🔍 Latest deploy log https://app.netlify.com/projects/endearing-brigadeiros-63f9d0/deploys/6a24d36ed8958e0008ae5b91

@github-actions

github-actions Bot commented Jun 6, 2026 •
edited
Loading

Copy link
Copy Markdown

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 1 package(s) with unknown licenses.
See the Details below.

License Issues

.github/workflows/e2e.yml

PackageVersionLicenseIssue Type
docker/setup-compose-actiondd8b913e8081779e7a75dd4ffd066e6ba62a289cNullUnknown License
Allowed Licenses: MIT, MIT-0, Apache-2.0, BSD-3-Clause, BSD-3-Clause-Clear, ISC, BSD-2-Clause, Unlicense, CC0-1.0, 0BSD, X11, MPL-2.0, MPL-1.0, MPL-1.1, MPL-2.0, OFL-1.1, Zlib, BlueOak-1.0.0, Ubuntu-font-1.0, Artistic-2.0, Python-2.0, EPL-2.0
Excluded from license check: pkg:npm/caniuse-lite, pkg:npm/path-is-inside, pkg:npm/unicode-match-property-value-ecmascript, pkg:npm/unicode-property-aliases-ecmascript, pkg:npm/uri-js

OpenSSF Scorecard

PackageVersionScoreDetails
actions/actions/checkout df4cb1c069e1874edd31b4311f1884172cec0e10 🟢 5.8
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained⚠️ 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST🟢 8SAST tool detected but not run on all commits
actions/crazy-max/ghaction-github-runtime 04d248b84655b509d8c44dc1d6f990c879747487 🟢 5.7
Details
CheckScoreReason
Maintained🟢 910 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 9
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/6 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy⚠️ 0security policy file not detected
SAST🟢 3SAST tool is not run on all commits -- score normalized to 3
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
actions/docker/setup-buildx-action 4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd 🟢 8.6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 9security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
License🟢 10license file detected
Packaging🟢 10packaging workflow detected
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
SAST🟢 10SAST tool is run on all commits
actions/docker/setup-compose-action dd8b913e8081779e7a75dd4ffd066e6ba62a289c UnknownUnknown
actions/step-security/harden-runner 9af89fc71515a100421586dfdb3dc9c984fbf411 🟢 8
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
CI-Tests🟢 1016 out of 16 merged PRs checked by a CI test -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review🟢 10all changesets reviewed
Contributors🟢 6project has 2 contributing companies or organizations -- score normalized to 6
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Maintained🟢 1015 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Vulnerabilities⚠️ 19 existing vulnerabilities detected
actions/actions/checkout df4cb1c069e1874edd31b4311f1884172cec0e10 🟢 5.8
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained⚠️ 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST🟢 8SAST tool detected but not run on all commits
actions/actions/checkout df4cb1c069e1874edd31b4311f1884172cec0e10 🟢 5.8
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained⚠️ 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST🟢 8SAST tool detected but not run on all commits
actions/step-security/harden-runner 9af89fc71515a100421586dfdb3dc9c984fbf411 🟢 8
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
CI-Tests🟢 1016 out of 16 merged PRs checked by a CI test -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review🟢 10all changesets reviewed
Contributors🟢 6project has 2 contributing companies or organizations -- score normalized to 6
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Maintained🟢 1015 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ -1no releases found
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Vulnerabilities⚠️ 19 existing vulnerabilities detected

Scanned Files

  • .github/workflows/e2e.yml
  • .github/workflows/npm.yml
  • .github/workflows/unused-dependencies.yml

@jescalada jescalada enabled auto-merge June 7, 2026 02:12
@codecov

codecov Bot commented Jun 7, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.68%. Comparing base (f59ebc7) to head (bffe243).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main    #1567   +/-   ##
=======================================
  Coverage   90.68%   90.68%           
=======================================
  Files          69       69           
  Lines        5741     5741           
  Branches      989      989           
=======================================
  Hits         5206     5206           
  Misses        517      517           
  Partials       18       18

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@jescalada jescalada merged commit bccf70c into main Jun 7, 2026
25 checks passed
@dependabot dependabot Bot deleted the dependabot/github_actions/github-actions-ee4cbb3667 branch June 7, 2026 02:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jescalada jescalada jescalada approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jescalada