chore(deps): update konflux-ci/release-service-automations digest to 83d9c2d

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
konflux-ci/release-service-automations (changelog)	action	digest	5da461e → 83d9c2d

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:18 PM UTC · Completed 8:24 PM UTC
Commit: ffde3b2 · View workflow run →

[fullsend-ai-review]

Review

Findings

Low

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under .github/ (protected path). The change is an automated Renovate digest bump authorized by .github/renovate.json configuration. Human approval is still required for protected-path changes.

Previous run

Looks good to me

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• .github/workflows/pr-ai-labeler.yaml
• .github/workflows/pr-assigner.yaml

Previous run (2)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both changed files are under .github/, a protected path requiring human approval. The PR has no linked issue justifying changes to governance/infrastructure files. The code change itself is a routine dependency digest update for konflux-ci/release-service-automations (from 5da461e to 83d9c2d) and no correctness, security, or style issues were found, but human review is required for all protected-path modifications.

Previous run (3)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under .github/, a protected path requiring human approval. This PR has no linked issue and no justification beyond the automated dependency update description for modifying governance/infrastructure files. While the change itself is a straightforward digest bump for konflux-ci/release-service-automations, protected-path changes require explicit authorization.
  Remediation: A human reviewer should verify the upstream commit 83d9c2d in konflux-ci/release-service-automations is legitimate and approve the workflow changes.

---

Labels: Trivial 2-line dependency digest update warrants minimal review effort label.

Previous run (4)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under .github/, a protected path requiring human approval. This PR has no linked issue providing authorization for modifying governance/infrastructure files. While the change is a mechanical dependency digest update (konflux-ci/release-service-automations SHA 5da461e → 83d9c2d) from the MintMaker/Renovate bot, protected-path changes always require explicit human review regardless of the change's nature.
  Remediation: A human maintainer should verify the new digest (83d9c2d809eab0e44b802a5983b086ac47b635ac) in the upstream release-service-automations repository and approve this PR.

Previous run (5)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under .github/, a protected path requiring human approval. This PR has no linked issue justifying the changes to governance/infrastructure files. While this is an automated Renovate digest bump for konflux-ci/release-service-automations (from 5da461e to 83d9c2d), human reviewers should verify the upstream commit is legitimate before merging, as these workflows run under pull_request_target with access to repository secrets (GITHUB_TOKEN, PR_ASSIGNER_PAT_TOKEN, PR_ASSIGNER_SLACK_WEBHOOK).
  Remediation: A human maintainer should verify the upstream commit digest in konflux-ci/release-service-automations and approve this protected-path change.

Previous run (6)

Review

Findings

Medium

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under .github/, a protected path requiring human approval. The PR provides sufficient context (automated dependency digest update from MintMaker/Renovate for konflux-ci/release-service-automations), but human approval is always required for changes to governance and infrastructure files regardless of context.

Previous run (7)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under .github/, a protected path requiring human approval. The PR has no linked issue and lacks justification for modifying governance/infrastructure files beyond the automated Renovate dependency description. While the change is a mechanical digest update (bumping konflux-ci/release-service-automations from 5da461e to 87615e0), protected-path changes always require explicit human review regardless of their mechanical nature.
  Remediation: A human reviewer should verify the upstream commit 87615e00a3a699a7cc473ed93d3203624e3b86f0 in konflux-ci/release-service-automations and approve this change.

Previous run (8)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under the .github/ protected path. This PR has no linked issue providing authorization for modifying governance/infrastructure files. While the change is a straightforward Renovate dependency digest bump for konflux-ci/release-service-automations, human approval is required for all protected-path changes.
  Remediation: A human reviewer should verify that the new digest (87615e0) corresponds to a trusted commit in konflux-ci/release-service-automations and approve the workflow changes.

---

Labels: Renovate bot PR updating GitHub Actions dependency digests.

Previous run (9)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under .github/, which is a protected path requiring human approval. This PR has no linked issue and no justification beyond the automated Renovate bot description for modifying governance/infrastructure files. While the change itself is a routine dependency digest update (SHA pin bump for konflux-ci/release-service-automations), protected-path changes require explicit authorization.
  Remediation: Link an authorizing issue or have a maintainer confirm the digest update is expected, then obtain human approval for the protected-path change.

Previous run (10)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under .github/, which is a protected path requiring human approval. The PR has no linked issue and the description does not explain why these governance/infrastructure files are being changed. While this is a routine Renovate bot digest update, protected-path changes always require explicit human review regardless of the change's mechanical nature.
  Remediation: A human reviewer must approve this PR. No code changes are needed — the digest update itself is correct.

Info

• [authorization] .github/workflows/pr-ai-labeler.yaml:17 — No linked issue found. Authorization is inferred from the mechanical nature of this change: Renovate bot updating the digest pin for konflux-ci/release-service-automations. This is a routine dependency maintenance operation.

• [scope-alignment] .github/workflows/pr-assigner.yaml:17 — Change scope matches PR title and description. This is a pure digest update with no functional changes to workflow logic, parameters, or permissions.

Previous run (11)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under the .github/ protected path. This PR has no linked issue providing authorization for changes to governance/infrastructure files. Human approval is required for all protected-path changes.
  Remediation: Ensure a maintainer reviews and approves the workflow digest update. For future automated dependency updates to protected paths, consider linking a standing issue or policy that authorizes routine Renovate digest bumps.

Low

• [whitespace-consistency] .github/workflows/pr-ai-labeler.yaml:17 — Pre-existing inconsistency: double-space before # main inline comment, while pr-assigner.yaml and other workflow files use single-space. Not introduced by this PR.

Previous run (12)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both files are under the .github/ protected path. This PR has no linked issue providing justification for modifying governance/infrastructure files. Human approval is required for all protected-path changes.
  Remediation: Link this PR to an issue or add a description explaining the rationale for the workflow changes, then obtain human approval.

Info

• [scope-authorization] .github/workflows/pr-ai-labeler.yaml — No linked issue for this automated digest update. Authorization is inferred from the mechanical nature of the change (Renovate bot updating pinned action digests in both pr-ai-labeler.yaml and pr-assigner.yaml) and the presence of Renovate configuration. This is standard automated maintenance.

Previous run (13)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under .github/, a protected path requiring human approval. This PR has no linked issue providing justification for modifying governance/infrastructure files. While the change is a mechanical Renovate digest update, protected-path changes always require explicit human review regardless of the change's nature.
  Remediation: A human reviewer must approve this PR. No code changes are needed — this finding enforces the governance requirement that protected-path modifications receive human sign-off.

Info

• [scope-authorization] .github/workflows/pr-ai-labeler.yaml — No linked issue for this PR. Authorization inferred from mechanical nature of change: automated Renovate digest update for konflux-ci/release-service-automations action. Repository has Renovate configured in .github/renovate.json, establishing automated dependency updates as authorized practice.

• [secret-exposure] .github/workflows/pr-assigner.yaml:22 — This workflow uses pull_request_target and passes a non-default PAT secret (PR_ASSIGNER_PAT_TOKEN) and a Slack webhook secret to an external action. The pinned SHA is being updated to a new digest. While SHA-pinning is correct practice, the security of this pattern depends on the code at the new commit in the external repository. This is a pre-existing pattern, not newly introduced by this diff.

Previous run (14)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under .github/, a protected path requiring human approval. This PR has no linked issue and no explicit justification for modifying governance/infrastructure files. While the change is a routine Renovate dependency digest update, protected-path changes always require human review regardless of the change type.

Low

• [whitespace-consistency] .github/workflows/pr-ai-labeler.yaml:17 — Inconsistent spacing before inline comment: this file uses two spaces before # main while all other workflow files in the repository (pr-assigner.yaml, pr.yml, gosec.yaml, codecov.yml) use a single space. Consider normalizing to single space for consistency.

Previous run (15)

Review

Findings

Medium

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under .github/, a protected path. This is a routine Renovate bot dependency digest update (konflux-ci/release-service-automations from 5da461e to 87615e0) with a clear description in the PR body. Human approval is always required for protected-path changes, regardless of context.

Previous run (16)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under .github/, a protected path requiring human approval. The PR has no linked issue providing justification for modifying governance/infrastructure files. While this is an automated dependency digest update (konflux-ci/release-service-automations 5da461e → 87615e0), protected-path changes always require explicit human review regardless of the change's mechanical nature.
  Remediation: A human maintainer must review and approve this change. No automated approval is permitted for protected paths.

Info

• [formatting-consistency] .github/workflows/pr-ai-labeler.yaml:17 — Pre-existing inconsistency: this file uses two spaces before # main while all other workflow files use one space. Not introduced by this PR.
• [authorization] .github/workflows/pr-ai-labeler.yaml:17 — No linked issue. Authorization inferred from the mechanical nature of the change: automated digest pin update by red-hat-konflux[bot].
• [scope-alignment] .github/workflows/pr-ai-labeler.yaml:17 — The PR title claims chore(deps) and the actual change matches exactly: two workflow files update the same action digest. No scope creep detected.
• [architectural-coherence] .github/workflows/pr-ai-labeler.yaml:17 — The change maintains the project's security posture by continuing to pin GitHub Actions to specific 40-character commit hashes rather than mutable tags.

Previous run (17)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under .github/, a protected path requiring human approval. This PR has no linked issue and the description does not provide specific justification for modifying governance/infrastructure workflow files beyond the generic Renovate template.
  Remediation: Ensure a human reviewer with appropriate permissions approves changes to .github/ workflow files. Consider linking to an issue or adding a PR description explaining why the protected files need updating.

Low

• [whitespace-consistency] .github/workflows/pr-ai-labeler.yaml:17 — Two spaces before inline comment # main is inconsistent with the single-space pattern used in pr-assigner.yaml (line 17) and gosec.yaml (lines 20, 26, 34, 43). This inconsistency is pre-existing (the old line also had two spaces), not introduced by this PR.
  Remediation: Change to single space before # main.

Info

• [scope-alignment] .github/workflows/pr-ai-labeler.yaml:17 — Change scope is appropriate for a chore(deps) classification. The PR modifies only digest hashes for GitHub Actions dependencies without altering workflow logic, permissions, triggers, or parameters.

Previous run (18)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under .github/, a protected path requiring human approval. The PR has no linked issue providing explicit authorization for modifying governance/infrastructure files. While this is a mechanical Renovate digest update, protected-path changes always require human review regardless of the change's nature.
  Remediation: A human maintainer must review and approve this PR. Protected-path changes cannot be auto-approved.

Info

• [authorization-implicit-mechanical-change] .github/workflows/pr-ai-labeler.yaml:17 — Mechanical dependency digest update by Renovate bot, updating konflux-ci/release-service-automations from commit 5da461e to 87615e0. No permissions, inputs, secrets, or workflow triggers were modified. Authorization inferred from the mechanical nature of the change.

Previous run (19)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under .github/, a protected path requiring human approval. This PR has no linked issue providing explicit authorization for modifying governance/infrastructure files. While the change is a straightforward Renovate bot digest update, protected-path changes require human review regardless of content.
  Remediation: A human maintainer must review and approve this PR. No code changes are needed — this finding reflects a governance requirement, not a code defect.

Info

• [dependency-update] .github/workflows/pr-ai-labeler.yaml:17 — Action pin digest updated from 5da461e to 87615e0 for konflux-ci/release-service-automations/pr-ai-labeler. This workflow uses pull_request_target and passes secrets.GITHUB_TOKEN. The action is pinned to a full SHA in the same organization's repository. Permissions block (contents: read, pull-requests: write) is unchanged and appropriately scoped.

• [dependency-update] .github/workflows/pr-assigner.yaml:17 — Action pin digest updated from 5da461e to 87615e0 for konflux-ci/release-service-automations/pr-assigner. This workflow uses pull_request_target and passes secrets.PR_ASSIGNER_PAT_TOKEN (a PAT with broader permissions than GITHUB_TOKEN) and secrets.PR_ASSIGNER_SLACK_WEBHOOK. The action is pinned to a full SHA, which mitigates supply-chain risk. Permissions block is unchanged and appropriately scoped.

Previous run (20)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under .github/, a protected path requiring human approval. The PR has no linked issue providing explicit authorization for modifying governance/infrastructure files. While the change is a mechanical Renovate dependency digest bump for konflux-ci/release-service-automations, protected-path changes always require human review regardless of content.
  Remediation: A human maintainer should review and approve this PR. No code changes are needed — the digest bump itself is correct.

Info

• [formatting-consistency] .github/workflows/pr-ai-labeler.yaml:17 — Inconsistent spacing before inline comment. This file uses two spaces before # main while all other workflow files in the repository consistently use a single space before inline comments.
  Remediation: Change the double space before # main to a single space to match the repository's established convention.

Previous run (21)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both modified files are under the .github/ protected path. This PR has no linked issue providing authorization for changes to governance/infrastructure files. Human approval is required for all protected-path changes.
  Remediation: A human reviewer must verify and approve this dependency digest update. Consider linking a tracking issue or having the Renovate bot configuration produce linked issues for .github/ changes.

Info

• [dependency-pin-update] .github/workflows/pr-ai-labeler.yaml:17 — Pinned action digest updated from 5da461e to 87615e0 for konflux-ci/release-service-automations/pr-ai-labeler. This action runs under pull_request_target with access to secrets.GITHUB_TOKEN and permissions contents:read, pull-requests:write. No permissions or secret usage changes in this diff.

• [dependency-pin-update] .github/workflows/pr-assigner.yaml:17 — Pinned action digest updated from 5da461e to 87615e0 for konflux-ci/release-service-automations/pr-assigner. This action runs under pull_request_target with access to secrets.PR_ASSIGNER_PAT_TOKEN and secrets.PR_ASSIGNER_SLACK_WEBHOOK. No permissions or secret usage changes in this diff.

• [scope-authorization] .github/workflows/pr-ai-labeler.yaml — No linked issue for this dependency digest update. Authorization is inferred from the mechanical nature of the change (automated Renovate bot digest update).

• [architectural-coherence] .github/workflows/pr-ai-labeler.yaml — Change maintains existing architecture: workflows continue to reference the same shared actions, only updating commit digests. No scope creep or architectural drift detected.

Previous run (22)

Review

Findings

High

• [protected-path] .github/workflows/pr-ai-labeler.yaml, .github/workflows/pr-assigner.yaml — Both changed files are under .github/, which is a protected path requiring human approval. The PR has no linked issue providing explicit authorization for modifying governance/infrastructure files. While the change is a mechanical Renovate bot dependency digest update (updating konflux-ci/release-service-automations from 5da461e to 87615e0), protected-path changes require a linked issue for authorization.
  Remediation: Obtain human reviewer approval for this protected-path change. No code changes are needed — this is a governance gate.

Info

• [authorization-inference] .github/workflows/pr-ai-labeler.yaml — No linked issue found. Authorization is inferred from the mechanical nature of this change: Renovate bot updating the konflux-ci/release-service-automations action digest. The repository has configured Renovate via .github/renovate.json.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.49%. Comparing base (13a2f01) to head (b353325).

❗ There is a different number of reports uploaded between BASE (13a2f01) and HEAD (b353325). Click for more details.

HEAD has 2 uploads less than BASE

Flag	BASE (13a2f01)	HEAD (b353325)
unit-tests	2	1
e2e-tests	1	0

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1682      +/-   ##
==========================================
- Coverage   87.43%   81.49%   -5.95%     
==========================================
  Files          34       34              
  Lines        3566     3566              
==========================================
- Hits         3118     2906     -212     
- Misses        285      512     +227     
+ Partials      163      148      -15     

Flag	Coverage Δ
e2e-tests	?
unit-tests	81.49% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 12 files with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 13a2f01...b353325. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:37 AM UTC · Completed 11:44 AM UTC
Commit: ffde3b2 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:54 PM UTC · Completed 4:00 PM UTC
Commit: ffde3b2 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:33 AM UTC · Completed 10:39 AM UTC
Commit: ffde3b2 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:42 PM UTC · Completed 2:47 PM UTC
Commit: 218f229 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:05 PM UTC · Completed 10:11 PM UTC
Commit: 218f229 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:43 AM UTC · Completed 10:49 AM UTC
Commit: 218f229 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:07 PM UTC · Completed 4:11 PM UTC
Commit: 218f229 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:33 PM UTC · Completed 7:37 PM UTC
Commit: 218f229 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:26 PM UTC · Completed 2:31 PM UTC
Commit: ec21706 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:33 AM UTC · Completed 1:38 AM UTC
Commit: ec21706 · View workflow run →

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:38 PM UTC · Completed 2:43 PM UTC
Commit: ec21706 · View workflow run →