Update GitHub Actions by tmt-renovate-bot[bot] · Pull Request #5109 · teemtee/tmt

tmt-renovate-bot · 2026-08-07T02:41:53Z

This PR contains the following updates:

Package	Type	Update	Change
actions/attest-build-provenance	action	minor	`v4.1.1` → `v4.2.2`
astral-sh/setup-uv	action	major	`v9.0.0` → `v10.0.1`
github/codeql-action	action	patch	`v4.37.4` → `v4.37.9`
re-actors/alls-green	action	minor	`v1.2.2` → `v1.3.0`
renovatebot/github-action	action	patch	`v46.2.0` → `v46.2.5`

Release Notes

actions/attest-build-provenance (actions/attest-build-provenance)

`v4.2.2`

Compare Source

[!NOTE]
As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead.

What's Changed

Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by @dependabot[bot] in #862

Full Changelog: actions/attest-build-provenance@v4.1.1...v4.2.2

astral-sh/setup-uv (astral-sh/setup-uv)

`v10.0.1`: 🌈 Tolerate transient manifest timeouts

Compare Source

Changes

Thank you @arguile- for making this action more resilient.

🐛 Bug fixes

Tolerate transient manifest timeouts @arguile- (#1016)

🧰 Maintenance

chore: update known checksums for 0.12.4 @github-actions[bot] (#1017)

📚 Documentation

docs: update version references to v10.0.0 @github-actions[bot] (#1014)

`v10.0.0`: 🌈 Disable automatic caching for sensitive events and new QOL features

Compare Source

Changes

Another breaking release, directly after v9.0.0 but we think the added security justifies that.

Extra security by default

If you use the default enable-cache: auto this will now DISABLE THE CACHE to protect against cache poisoning for the following events:

pull_request_target
workflow_run
release

You can read the full reasoning in #984

`version: latest-known`

- name: Install the latest version of uv known to setup-uv
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version: "latest-known"

This will now install the latest version with a checksum that is known by this action. The known uv checksums are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.

Read python version from `.tool-versions`

- name: Install uv based on the version defined in .tool-versions and also set python
  uses: astral-sh/setup-uv@v10.0.0
  with:
    version-file: "pyproject.toml"

Will now also set the python version if it is defined in .tool-versions. You can read the details in the docs

🚨 Breaking changes

Disable automatic caching for sensitive events @eifinger (#992)

🐛 Bug fixes

Reject paths in .tool-versions @eifinger (#1007)

🚀 Enhancements

Read Python version from .tool-versions @eifinger (#996)
Add latest-known version selector @eifinger (#993)

🧰 Maintenance

Require pull requests for Dependabot rollups @eifinger (#1005)
ci: pin Alpine container image @eifinger (#995)
chore: update known checksums for 0.12.3 @github-actions[bot] (#991)
chore: update known checksums for 0.12.2 @github-actions[bot] (#985)
chore: update known checksums for 0.12.1 @github-actions[bot] (#982)
chore: update known checksums for 0.12.0 @github-actions[bot] (#981)
chore: update known checksums for 0.11.31/0.11.32 @github-actions[bot] (#972)

📚 Documentation

docs: update version references to v9.0.0 @github-actions[bot] (#971)

⬆️ Dependency updates

chore(deps): roll up Dependabot updates @eifinger (#1013)
chore(deps): roll up Dependabot updates @eifinger (#1004)
chore(deps): roll up Dependabot updates @eifinger (#994)
chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 @dependabot[bot] (#976)
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 @dependabot[bot] (#980)

github/codeql-action (github/codeql-action)

`v4.37.9`

Compare Source

Update default CodeQL bundle version to 2.26.4. #4106

`v4.37.8`

Compare Source

No user facing changes.

`v4.37.7`

Compare Source

Update default CodeQL bundle version to 2.26.3. #4085

`v4.37.6`

Compare Source

Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

`v4.37.5`

Compare Source

Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

re-actors/alls-green (re-actors/alls-green)

`v1.3.0`

Compare Source

Sometimes these releases take time. Cherish it.

🛡️ What's Unmessed

[!caution]

There was a small command injection risk in prior versions. I consider it very low because of the specifics of the action use case. But still, do upgrade, okay?

@illera88 💰 fixed this template injection bug in #37 by passing inputs via env vars.

See GHSA-gj76-h2ch-5m76 for more detail that was first reported by @Corbynx010 💰 while I was at EuroPython.

✨ What's Improved

I did a bunch of internal refactoring including hints of what @max-sixty 💰 reported in #23. And took a small patch of @krokofant 💰 in. This involved a bunch of preparatory infra work with testing infra.

One notable improvement is that now thanks to @tomasr8 💰's and @hugovk 💰's UX suggestions in #31, the gate status output is colored in the console and should be easier to scan in the log output per line. They entries now have leading ✓/❌ acceptance marks and the actual incoming job outcomes are labeled with 🟢/🔴/⬜/⚫.

🐛 What's Fixed

The job-statuses summary could print "Some of the allowed to be skipped jobs did not succeed" based on the wrong condition — it's now tied to allowed-skips as intended, not allowed-failures.

💪 New Contributors

@Corbynx010 💰 lurked in GHSA-gj76-h2ch-5m76 before everyone else 😉
@illera88 made their first contribution in #37 and GHSA-gj76-h2ch-5m76
@krokofant and @max-sixty first contributed in #23
@tomasr8 and @hugovk in #31

🪞 Full Diff: re-actors/alls-green@v1.2.2...v1.3.0

🧔‍♂️ Release Manager: @webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

renovatebot/github-action (renovatebot/github-action)

`v46.2.5`

Compare Source

Documentation

update references to renovatebot/github-action to v46.2.4 (c2ba0df)

Miscellaneous Chores

deps: update node.js to v24.20.0 (8bff989)

Build System

deps: lock file maintenance (40119c0)

Continuous Integration

deps: update ghcr.io/renovatebot/renovate docker tag to v44.40.0 (7776f7b)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.43.1 (1a8a884)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.44.0 (94a8afa)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.45.2 (91a1ccd)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.45.3 (9df3426)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.45.4 (c0c2060)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.46.0 (246e8c4)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.46.1 (a2cef85)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.46.2 (3ce659c)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.46.4 (cd8ceb2)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.46.5 (8f94c87)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.46.6 (7997c61)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.48.0 (a60af3a)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.48.1 (508cd10)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.48.2 (cca913a)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.48.3 (d450fc2)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.49.0 (0afb379)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.49.1 (c409f02)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.50.1 (dbb0a9b)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.50.2 (f51cd98)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.50.3 (34b46a4)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.51.0 (ea6c45c)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.51.2 (9774ab2)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.52.0 (e753d3e)
deps: update ghcr.io/zizmorcore/zizmor docker tag to v1.30.0 (92becf5)
deps: update zizmorcore/zizmor-action action to v0.6.3 (ea548b4)

`v46.2.4`

Compare Source

Documentation

update references to renovatebot/github-action to v46.2.3 (42d0056)

Build System

deps: lock file maintenance (e3c0c2e)

`v46.2.3`

Compare Source

Documentation

update references to renovatebot/github-action to v46.2.2 (49f4ea0)

Miscellaneous Chores

deps: update actions/cache action to v6 (#1070) (90e0199)
deps: update actions/setup-node action to v7 (#1071) (498e972)
deps: update commitlint monorepo to v21 (#1073) (22967b6)
deps: update dependency @semantic-release/git to v11 (#1074) (bea653f)
deps: update dependency @tsconfig/node24 to v24.0.5 (72cf06d)
deps: update dependency esbuild to v0.28.2 (0e6d970)
deps: update dependency eslint-plugin-json to v5 (#1075) (63f2879)
deps: update dependency globals to v17.10.0 (d402615)
deps: update dependency globals to v17.11.0 (675198d)
deps: update dependency semantic-release to v25.0.9 (ac9a74d)
deps: update dependency typescript-eslint to v8.66.0 (af5132f)
deps: update dependency typescript-eslint to v8.67.0 (39cdfd1)
fix zizmor errors (#1072) (613ec41)

Build System

deps: lock file maintenance (7df1c30)

Continuous Integration

deps: update dependency actions/checkout to v7 (#1077) (d6180bb)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.17.2 (8695952)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.17.3 (82eda2d)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.20.1 (f478bc0)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.22.0 (755e0d3)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.23.0 (3cb9274)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.23.3 (4436421)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.24.2 (15b3538)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.24.3 (489f1d0)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.25.0 (3683bf4)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.26.0 (e133651)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.27.0 (e22f3f6)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.28.0 (2057af5)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.29.2 (56c415f)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.29.4 (88330ca)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.29.5 (cf40db9)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.30.0 (359d861)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.30.1 (be07738)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.30.2 (4c3519a)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.30.3 (a08a921)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.30.4 (fff9ff0)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.31.0 (e5d35d4)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.32.1 (be027ab)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.32.2 (e5b51b4)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.32.5 (21f4128)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.32.6 (c3a9bd4)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.33.2 (ef454f0)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.34.0 (ec74cb7)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.34.3 (ba4c5a2)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.35.0 (7313a0d)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.35.1 (4e11059)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.35.2 (3ae4864)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.35.3 (f0c13d2)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.35.4 (c16c31c)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.36.0 (8778c4a)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.37.1 (aaaf809)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.38.0 (67e8c5f)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.39.0 (a7eb6cf)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.39.1 (faf9cdc)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.39.2 (2e028a9)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.39.3 (7359be7)

`v46.2.2`

Compare Source

Documentation

update references to renovatebot/github-action to v46.2.1 (7cb7826)

Miscellaneous Chores

deps: update dependency globals to v17.9.0 (fe8cd8f)
deps: update dependency lint-staged to v17.3.0 (0170d05)
deps: update dependency npm-run-all2 to v9.0.3 (28cc32f)
deps: update node.js to v24.19.0 (7871c30)
deps: update pnpm/action-setup action to v6.0.10 (d50b9ec)

Build System

deps: lock file maintenance (aff7566)

Continuous Integration

deps: update ghcr.io/renovatebot/renovate docker tag to v44.10.0 (06d3a61)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.11.0 (01f82e1)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.11.1 (cbdd6e6)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.11.3 (b198ad1)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.11.4 (08eadc2)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.11.6 (90ab0cf)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.11.8 (7450504)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.12.0 (7e359f7)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.13.1 (8a0db28)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.13.2 (aaca99e)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.13.3 (a0789b3)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.14.1 (3c34056)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.14.10 (e7b39a3)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.14.12 (043e499)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.14.3 (#1069) (c2d39c0)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.14.5 (ed777cd)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.14.7 (670a1df)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.14.8 (b057f09)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.16.1 (7b73ff6)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.17.0 (28c55b1)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.17.1 (216aee1)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.7.4 (9d9a18a)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.8.0 (a339330)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.8.1 (f82ef19)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.9.2 (2a6f771)

`v46.2.1`

Compare Source

Documentation

update references to renovatebot/github-action to v46.2.0 (b48aa6c)

Miscellaneous Chores

deps: update dependency globals to v17.8.0 (3e46bd7)
deps: update dependency lint-staged to v17.2.0 (9c685f2)
deps: update node.js to v24.18.1 (f525256)

Build System

deps: lock file maintenance (3d8211a)

Continuous Integration

deps: update ghcr.io/renovatebot/renovate docker tag to v44.0.1 (d471d52)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.2.1 (5cb64df)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.2.2 (a6b5808)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.2.3 (ab4d1eb)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.3.0 (a427843)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.3.3 (2ac8329)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.4.0 (7665449)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.4.2 (0166c9f)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.4.3 (8662b55)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.4.5 (1e71262)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.4.6 (7bec40c)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.5.0 (d146e8b)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.5.1 (ddd5dca)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.5.2 (0731dab)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.5.3 (700f3b5)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.6.0 (7edb80e)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.7.0 (127e8ef)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.7.1 (f7532d1)
deps: update ghcr.io/renovatebot/renovate docker tag to v44.7.2 (0fcd35b)
deps: update ghcr.io/zizmorcore/zizmor docker tag to v1.29.0 (#1068) (581f6ac)
deps: update zizmorcore/zizmor-action action to v0.6.2 (e36e81c)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

tmt-renovate-bot Bot added the renovate label Aug 7, 2026

tmt-renovate-bot Bot temporarily deployed to renovate August 7, 2026 02:41 Inactive

happz approved these changes Aug 7, 2026

View reviewed changes

happz added this to planning Aug 7, 2026

happz moved this to review in planning Aug 7, 2026

tmt-renovate-bot Bot force-pushed the renovate/github-actions branch from 4e89b44 to fcec72b Compare August 14, 2026 01:59

tmt-renovate-bot Bot deployed to renovate August 14, 2026 01:59 Active

tmt-renovate-bot Bot force-pushed the renovate/github-actions branch from fcec72b to 781db31 Compare August 21, 2026 01:20

tmt-renovate-bot Bot deployed to renovate August 21, 2026 01:20 Active

tmt-renovate-bot Bot force-pushed the renovate/github-actions branch from 781db31 to 709766c Compare August 28, 2026 09:59

tmt-renovate-bot Bot deployed to renovate August 28, 2026 09:59 Active

Update GitHub Actions

4b20ed5

tmt-renovate-bot Bot force-pushed the renovate/github-actions branch from 709766c to 4b20ed5 Compare September 4, 2026 03:16

tmt-renovate-bot Bot deployed to renovate September 4, 2026 03:16 Active

Navigation Menu

Uh oh!

Update GitHub Actions - #5109

Update GitHub Actions#5109
tmt-renovate-bot[bot] wants to merge 1 commit into
mainfrom
renovate/github-actions

tmt-renovate-bot Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

tmt-renovate-bot Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

v10.0.1: 🌈 Tolerate transient manifest timeouts

Changes

🐛 Bug fixes

🧰 Maintenance

📚 Documentation

v10.0.0: 🌈 Disable automatic caching for sensitive events and new QOL features

Changes

Extra security by default

version: latest-known

Read python version from .tool-versions

🚨 Breaking changes

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

🛡️ What's Unmessed

✨ What's Improved

🐛 What's Fixed

💪 New Contributors

Documentation

Miscellaneous Chores

Build System

Continuous Integration

Documentation

Build System

Documentation

Miscellaneous Chores

Build System

Continuous Integration

Documentation

Miscellaneous Chores

Build System

Continuous Integration

Documentation

Miscellaneous Chores

Build System

Continuous Integration

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

tmt-renovate-bot Bot commented Aug 7, 2026 •

edited

Loading

`v10.0.1`: 🌈 Tolerate transient manifest timeouts

`v10.0.0`: 🌈 Disable automatic caching for sensitive events and new QOL features

`version: latest-known`

Read python version from `.tool-versions`