chore: update tool versions and pin unpinned dependencies - #130
Merged
Conversation
Updates: - trivy: v0.69.3 -> v0.74.0 (binary was ~5.5 months old, stale vulnerability database). Also pins the trivy-action to the same version so filesystem and docker scans no longer run different engines (the action defaulted to v0.70.0). - docker/setup-buildx-action: v4.2.0 -> v4.3.0 - github/codeql-action/upload-sarif: v4.37.7 -> v4.37.8 - node: 24.16.0 -> 24.19.0 (current LTS) Pinning (previously mutable / unpinned): - dtolnay/rust-toolchain@stable -> SHA pin. The stable branch only sets the toolchain input default, so publish-crates-io.yml now passes toolchain: stable explicitly to keep behaviour identical. Rust itself is still resolved at runtime. - semgrep -> ==1.174.0 - bandit[toml] -> ==1.9.4 Validated with actionlint; all pinned SHAs and versions verified to resolve upstream.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (10)
Included review availability: 1 review is currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour. 📝 WalkthroughWalkthroughThe pull request updates Node.js, Rust, Trivy, Semgrep, Bandit, CodeQL, and Docker Buildx versions across CI, publishing, release, and security workflows. It also aligns the documented Node.js version. ChangesWorkflow maintenance
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to This PR updates security and build tooling and pins previously floating dependencies to make workflow runs more consistent; no actionable merge-blocking risk remains after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates
docker/setup-buildx-actiongithub/codeql-action/upload-sarifDer wichtigste Punkt ist Trivy: die Binary war auf v0.69.3 vom 2026-03-03 gepinnt, also ~5,5 Monate alt — bei einem Vulnerability-Scanner heißt das eine veraltete Detection-Engine im Security-Gate. Keine Breaking Changes in den Release Notes v0.70→v0.74.
Zusätzlich war die Trivy-Version inkonsistent:
trivy-action@v0.36.0bringt per Default v0.70.0 mit, während die manuellen Installationen v0.69.3 nutzten — Filesystem- und Docker-Scan liefen also mit unterschiedlichen Engines. Die Action bekommt jetzt explizitversion: "v0.74.0", damit alle drei Scans identisch sind.Die Trivy-Cache-Keys enthalten die Version und invalidieren dadurch automatisch.
Pinning
Drei Stellen umgingen bisher das ansonsten konsequente SHA-Pinning:
dtolnay/rust-toolchain@stablewar ein mutable Branch-Ref — genau das Supply-Chain-Risiko, gegen das das SHA-Pinning überall sonst schützt, und für Dependabot unsichtbar. Jetzt auf SHA4360b52gepinnt.Wichtig zum Verhalten: der
stable-Branch setzt lediglich den Default destoolchain-Inputs, er wählt nicht zur Laufzeit eine Rust-Version.test-and-build.ymlübergibttoolchainohnehin schon explizit;publish-crates-io.ymltat das nicht und bekommt deshalb jetzttoolchain: stableexplizit gesetzt, damit das Verhalten unverändert bleibt. Rust selbst wird weiterhin zur Laufzeit aufgelöst — das SHA pinnt nur den Action-Code.pip install semgrep→==1.174.0pip install bandit[toml]→==1.9.4Beide waren komplett ungepinnt, jeder Run zog die neueste Version. Das machte Builds nicht-reproduzierbar und war ein ungeprüfter Ausführungspfad im Security-Gate. Trade-off: diese Pins brauchen künftig manuelle Pflege, damit die Detection-Regeln nicht veralten — Dependabot deckt
pip installinrun-Steps nicht ab.Nicht geändert
Die übrigen 22 Actions sind bereits auf der neuesten Version (checkout v7.0.1, cache v6.1.0, setup-node v7.0.0, upload/download-artifact, attest v4.2.2, anchore/scan-action v7.4.0, setup-uv v10.0.1, build-push-action v7.3.0, login-action v4.6.0, action-gh-release v3.0.2, zaproxy/*, nx-set-shas v5.0.1, pip-audit v1.1.0).
Validierung
actionlint .github/workflows/*.yml→ exit 0version-Input als vontrivy-action@v0.36.0unterstützt bestätigt (nicht stillschweigend wirkungslos)Summary by CodeRabbit
Chores
Documentation