Repository navigation
chore(deps): bump the github-actions group and gh-aw CLI to v1.2.1 - #287
Conversation
Carries Dependabot's github-actions group update from #285: - github/codeql-action/init and analyze v4.39.1 -> v4.39.3 - github/gh-aw-actions/setup-cli v0.93.6 -> v1.2.1 and moves the installed gh-aw CLI (`version:`) to v1.2.1 with the action, as TestCopilotSetupActionAndCLIVersionsMatch requires. The Dependabot head failed that test in Lint and Build & Test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
HemSoft
added
dependencies
|
@sfl review |
|
@codex review |
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
![hemsoft-sfl-reviewer[bot]](https://avatars.githubusercontent.com/in/5406096?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Verdict: PASS • Round 1
Confidence: 8/10 · Project risk: 3/10 (gh-x)
Review done by claude-opus-5-5 (same family: same-family: codex gated: codex Weekly 116% SUS 86 🟡 pause, defer)
Moves the CodeQL init and analyze actions from v4.39.1 to v4.39.3, and moves gh-aw-actions/setup-cli and its installed CLI version together from v0.93.6 to v1.2.1. Each SHA pin matches its upstream tag, and the action tag equals the CLI version as TestCopilotSetupActionAndCLIVersionsMatch requires, so I found no blocking defect.
🔨 Full-Spectrum Review Summary
Effort: high
Review time: 1m 8s
Token count: Unavailable
| Pass | 🔴 Critical | 🟠 High | 🟡 Medium | ⚪ Low |
|---|---|---|---|---|
| 🔒 Security | 0 | 0 | 0 | 0 |
| ✅ Accuracy | 0 | 0 | 0 | 0 |
| 🧰 Quality & Maintainability | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 |
Key Findings
No material defects found.
Coverage
- Files reviewed:
.github/workflows/ci.yml.github/workflows/copilot-setup-steps.yml
- Context read:
.github/scripts/copilot_setup_test.go.github/dependabot.yml.github/mcp.json.github/scripts/audit_inventory_test.go.github/scripts/changelog-check/main.gogithub/gh-aw-actions setup-cli/action.yml at `406c7719`github/gh-aw-actions setup-cli/install.sh at `406c7719`github/gh-aw release v1.2.1 notes
- Verified:
- Compare
base_commit.shaiscd4c2357…and the single commit is28d61c73…(ahead_by 1, behind_by 0) - PR
baseRefOidandheadRefOidmatch the reserved SHAs - codeql-action tag
v4.39.3dereferences to commit33d7b85d…, matching both new pins - codeql-action tag
v4.39.1dereferences to9b325408…, so the old pins were correct and the bump is consistent - gh-aw-actions tag
v1.2.1dereferences to commit406c7719…, matching the new pin - gh-aw-actions tag
v0.93.6dereferences to9b623906…, matching the old pin - The
setup-clitag commentv1.2.1equalswith.version: v1.2.1, which satisfies the test's regex and equality check - No other
codeql-actionorsetup-clireferences at head remain on old versions - At the new pin,
setup-cliaccepts an exact release tag and checks SHA256 checksums by default - gh-aw v1.2.1 and v0.93.6 are both marked prerelease upstream, as the PR text says
- The workflow permissions (
contents: read) are unchanged
- Compare
- Not verified:
- Runtime behavior of the v1.2.1 gh-aw CLI and
gh aw mcp-serverused by.github/mcp.json.copilot-setup-stepsruns only on push or dispatch, so PR CI may not exercise the install - Behavior changes between CodeQL action v4.39.1 and v4.39.3 beyond the tag-to-SHA mapping
- Breaking changes across the gh-aw 0.x to 1.x major bump. I read only the v1.2.1 release highlights
- The PR's claims about #285 CI failures and the local
go testpass, which I did not check against CI logs
- Runtime behavior of the v1.2.1 gh-aw CLI and
- Tests run: None. Reviewer execution is disabled.
HemSoft full-spectrum review • 3 evidence-based passes • Reviewed head 28d61c73e324978289a8d6c1ec1be59e02b1270a • SFL v0
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@sfl review |
|
@codex review |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
✅ Verdict: PASS • Round 2
Confidence: 8/10 · Project risk: 3/10 (gh-x)
Since round 1
New: 0; still open (repeated): 0; resolved: 0.
Resolved means no matching finding in this review, not independent proof of a fix.
New (0)
- None.
Still open (repeated) (0)
- None.
Resolved (0)
- None.
Review done by gpt-6.1-sol (adversarial to claude)
Updates CodeQL to v4.39.3 and the gh-aw setup action and installed CLI together to v1.2.1. Security, accuracy and quality passes found no evidenced defect within the static coverage, supporting approval without proving correctness.
🔨 Full-Spectrum Review Summary
Effort: high
Review time: 1m 16s
Token count: Unavailable
| Pass | 🔴 Critical | 🟠 High | 🟡 Medium | ⚪ Low |
|---|---|---|---|---|
| 🔒 Security | 0 | 0 | 0 | 0 |
| ✅ Accuracy | 0 | 0 | 0 | 0 |
| 🧰 Quality & Maintainability | 0 | 0 | 0 | 0 |
| Total | 0 | 0 | 0 | 0 |
Key Findings
No material defects found.
Coverage
- Files reviewed:
.github/workflows/ci.yml.github/workflows/copilot-setup-steps.yml
- Context read:
.github/scripts/copilot_setup_test.go.github/mcp.json.github/dependabot.ymlREADME.mdgithub/gh-aw-actions/setup-cli/action.ymlgithub/gh-aw-actions/setup-cli/install.shgithub/codeql-action/init/action.ymlgithub/codeql-action/analyze/action.ymlgithub/gh-aw/pkg/cli/mcp_server_command.gogithub/gh-aw/pkg/cli/mcp_server.go
- Verified:
- Compare
base_commit.shaequals3e5444bc9d45d755ec797632cad625bceea989a7; final head commit equals9b82e037737267227a65f5f8f216985dc3548bee. - Inspected the complete two-file diff and both full workflows at the exact head.
- The complete head tree contains no
AGENTS.md,CLAUDE.md, CONTRIBUTING or CODING instruction files. - Upstream annotated tags resolve to both new immutable action pins.
- The setup action comment and
with.versionsatisfy the existing version-equality test by inspection. - At the pinned action SHA, the installer honors exact versions, checks installed-version mismatches, and provides download retries and checksum validation on its manual fallback.
- The
v1.2.1release listslinux-amd64andchecksums.txtassets. - CodeQL action inputs accept the configured language/build-mode matrix; both steps use the same SHA and retain existing permissions.
- The MCP caller matches the stdio command implemented at gh-aw commit
8f3224323bdfd3ae8574c99c5da8a65d450577bb; workflow-writing tools default to disabled.
- Compare
- Not verified:
- Runtime installation, hosted runner behavior and MCP interoperability were not verified because execution was forbidden.
- CodeQL bundled JavaScript, downloaded release binaries and all gh-aw tool handlers were not exhaustively audited.
- README context was inspected only in excerpts; unrelated documentation claims were outside this dependency-update review.
- Tests run: None. Reviewer execution is disabled.
HemSoft full-spectrum review • 3 evidence-based passes • Reviewed head 9b82e037737267227a65f5f8f216985dc3548bee • SFL v0
Summary
Replaces Dependabot's #285 (github-actions group) with the one change it was missing.
github/codeql-action/initandanalyze: v4.39.1 → v4.39.3 (Dependabot's SHA pins, unchanged)github/gh-aw-actions/setup-cli: v0.93.6 → v1.2.1 (Dependabot's SHA pin; the annotated tagv1.2.1resolves to406c7719e31d7fe354224d4bb8fe3d4aeb47da1c)with.version): v0.93.6 → v1.2.1, so the action and the CLI stay on the same releaseWhy #285 failed
TestCopilotSetupActionAndCLIVersionsMatch(.github/scripts/copilot_setup_test.go) requires the setup-cli tag comment to equal the installed CLI version. Dependabot bumps only theuses:line, so Lint and Build & Test failed withsetup-cli action tag v1.2.1 differs from installed CLI v0.93.6; update both pins together. Quality Gate failed only because those jobs failed. The Codex gate failed because nobody requested a Codex review on that head. A token withoutworkflowscope can't fix this on Dependabot's branch, so this branch carries it.gh-aw v1.2.1 is marked prerelease upstream, like the v0.93.6 it replaces.
Validation
go test -count=1 ./.github/scripts/passes locally on this head (go1.26.10).🤖 Generated with Claude Code