Skip to content

chore(deps): update github workflows #6733

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sentrivana merged 1 commit into from
Aug 13, 2026
Merged

chore(deps): update github workflows #6733

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/ai-integration-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,17 +19,17 @@ jobs:

steps:
- name: Setup Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
Comment thread
cursor[bot] marked this conversation as resolved.
with:
python-version: 3.14t

- name: Setup Node.js
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
Comment thread
sentry-warden[bot] marked this conversation as resolved.
node-version: '20'
node-version: '24'

- name: Checkout repo
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
token: ${{ secrets.GITHUB_TOKEN }}

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/changelog-preview.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,6 @@ permissions:

jobs:
changelog-preview:
uses: getsentry/craft/.github/workflows/changelog-preview.yml@6143e76379c342e247687c4ab5c83d8b900cc273 # v2
uses: getsentry/craft/.github/workflows/changelog-preview.yml@cd1e8294061fd970b40d98b77aaa109cb1e00e78 # v2
secrets:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
12 changes: 6 additions & 6 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,9 @@ jobs:
timeout-minutes: 10

steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0

@cursor cursor Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Invalid setup-uv action pin

High Severity

astral-sh/setup-uv is pinned to ae62891… labeled # v10.0.0, but no such release or commit exists. The PR targets v9.0.0, whose digest is c771a70…. This invalid pin is repeated across CI workflows and templates, so jobs that install uv fail when resolving the action.

Additional Locations (2)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 9d5f943. Configure here.

with:
python-version: 3.14

Expand All @@ -46,9 +46,9 @@ jobs:
timeout-minutes: 10

steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
python-version: 3.14
- name: Build Packages
Expand All @@ -71,9 +71,9 @@ jobs:
timeout-minutes: 10

steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
python-version: 3.14

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/enforce-license-compliance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,6 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: 'Enforce License Compliance'
uses: getsentry/action-enforce-license-compliance@48236a773346cb6552a7bda1ee370d2797365d87 # main
uses: getsentry/action-enforce-license-compliance@d0aa91b82375e45135e96c02f17ce3b8002867cd # main
with:
fossa_api_key: ${{ secrets.FOSSA_API_KEY }}
4 changes: 2 additions & 2 deletions .github/workflows/flaky-test-detector.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ jobs:
environment: AI Integrations Tests

Comment thread
sentry-warden[bot] marked this conversation as resolved.
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
Comment thread
sentry-warden[bot] marked this conversation as resolved.

# --- Step A: deterministic collection of UNTRUSTED CI logs -----------
# Runs with the read-only GITHUB_TOKEN. No LLM here. Writes failure logs
Expand Down Expand Up @@ -108,7 +108,7 @@ jobs:
# and the repo, and writes the issue body to flaky-issue-body.md.
- name: Analyze logs and summarize flaky tests
if: steps.collect.outputs.collected != '0'
uses: anthropics/claude-code-action@11ba60486e4aec9ddfeafcf4bb3f00b028ac2c16 # v1.0.142
uses: anthropics/claude-code-action@239e3a730883eeb5c53db12b0fc9573b3024b126 # v1.0.191
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
github_token: ${{ github.token }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,12 +26,12 @@ jobs:
with:
app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
Comment thread
sentry-warden[bot] marked this conversation as resolved.
with:
token: ${{ steps.token.outputs.token }}
fetch-depth: 0
- name: Prepare release
uses: getsentry/craft@6143e76379c342e247687c4ab5c83d8b900cc273 # v2.26.9
uses: getsentry/craft@cd1e8294061fd970b40d98b77aaa109cb1e00e78 # 2.30.1
env:
GITHUB_TOKEN: ${{ steps.token.outputs.token }}
with:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-agents.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

Check warning on line 27 in .github/workflows/test-integrations-agents.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

`actions/checkout` version comment falsely claims non-existent v7.0.1 

The comment `# v7.0.1` does not match any official `actions/checkout` release, which undermines auditability of the pinned dependency.
Comment thread
sentry-warden[bot] marked this conversation as resolved.

@sentry-warden sentry-warden Bot Aug 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/checkout version comment falsely claims non-existent v7.0.1

The comment # v7.0.1 does not match any official actions/checkout release, which undermines auditability of the pinned dependency.

Evidence
  • GitHub's official actions/checkout repository has not published a v7.x release; the latest major release is v4.x.
  • The previous replacement in this same line also claimed a non-existent version (# v6.0.3), showing a systemic error in the versioning metadata.
  • actions/upload-artifact in the same file is similarly tagged with # v7.0.1 even though that official action has also not reached v7.
  • Because these workflows rely on pinned commit hashes for supply-chain security, an incorrect version comment makes it impossible to quickly verify at merge time whether the intended secure version is actually being used.
Also found at 1 additional location
  • scripts/split_tox_gh_actions/templates/test_orchestrator.jinja:53-55

Identified by Warden · find-bugs · NBK-E68

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-ai-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-ai.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,11 +22,11 @@
env:
# 3.6/3.7 run in the python:X.Y container; tell uv to use that system Python.
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}

Check failure on line 25 in .github/workflows/test-integrations-ai.yml

View check run for this annotation

@sentry/warden / warden: code-review

[8FW-FWB] actions/checkout updated to non-existent major version v7.0.1 (additional location) 

The pinned `actions/checkout` commit claims v7.0.1, a version that does not exist in the official repository, indicating a likely supply-chain compromise or bot misconfiguration that will break all affected CI workflows.
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

Check warning on line 27 in .github/workflows/test-integrations-ai.yml

View check run for this annotation

@sentry/warden / warden: code-review

astral-sh/setup-uv version comment may be incorrect and SHA unverified 

The workflow pins `astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d` with comment `# v10.0.0`. This version annotation has not been verified in-repo, and the same SHA is propagated from Jinja templates to many generated workflow files. Because this action installs tooling with workflow privileges, verify that the pinned SHA corresponds to an official, trusted release before approving.

@sentry-warden sentry-warden Bot Aug 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

astral-sh/setup-uv version comment may be incorrect and SHA unverified

The workflow pins astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d with comment # v10.0.0. This version annotation has not been verified in-repo, and the same SHA is propagated from Jinja templates to many generated workflow files. Because this action installs tooling with workflow privileges, verify that the pinned SHA corresponds to an official, trusted release before approving.

Evidence
  • scripts/split_tox_gh_actions/templates/test_group.jinja:77 and scripts/split_tox_gh_actions/templates/test_orchestrator.jinja:57 both hardcode the same astral-sh/setup-uv SHA and comment.
  • These templates generate workflow files including .github/workflows/test-integrations-ai.yml:29, .github/workflows/ci.yml:27, and at least 15 other workflow files.
  • No in-repo lockfile, checksum, or release verification exists for this SHA.
  • The # v10.0.0 comment is the only visible provenance for the pin; GitHub Actions executes the commit that the SHA points to regardless of the comment accuracy.

Identified by Warden · code-review · UCF-9ZY

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-cloud.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-common.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test-integrations-dbs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
os: [ubuntu-22.04]
services:
postgres:
image: ghcr.io/getsentry/image-mirror-library-postgres:17-alpine
image: ghcr.io/getsentry/image-mirror-library-postgres:18-alpine

Check warning on line 24 in .github/workflows/test-integrations-dbs.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

Non-existent PostgreSQL 18 image breaks CI service containers 

The postgres service image was bumped to `18-alpine`, but PostgreSQL 18 has not been released and the mirror image does not exist, causing all dependent workflow jobs to fail on container startup.
Comment thread
sentry-warden[bot] marked this conversation as resolved.
env:
POSTGRES_PASSWORD: sentry
# Set health checks to wait until postgres has started
Expand Down Expand Up @@ -54,9 +54,9 @@
SENTRY_PYTHON_TEST_MYSQL_PASSWORD: sentry
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
Comment thread
sentry-warden[bot] marked this conversation as resolved.
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
enable-cache: false
- name: "Setup ClickHouse Server"
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-flags.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
Comment thread
sentry-warden[bot] marked this conversation as resolved.
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-gevent.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-graphql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

Check failure on line 27 in .github/workflows/test-integrations-graphql.yml

View check run for this annotation

@sentry/warden / warden: code-review

actions/checkout updated to non-existent major version v7.0.1 

The pinned `actions/checkout` commit claims v7.0.1, a version that does not exist in the official repository, indicating a likely supply-chain compromise or bot misconfiguration that will break all affected CI workflows.

@sentry-warden sentry-warden Bot Aug 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/checkout updated to non-existent major version v7.0.1

The pinned actions/checkout commit claims v7.0.1, a version that does not exist in the official repository, indicating a likely supply-chain compromise or bot misconfiguration that will break all affected CI workflows.

Evidence
  • The diff adds actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 at line 27.
  • actions/checkout has no public v6 or v7 release; the latest major version in the canonical repository is v4.
  • The same non-existent v7 label is applied to actions/setup-node and actions/upload-artifact across every changed workflow file, which points to a systemic compromise or Renovate misconfiguration rather than a one-off typo.
Also found at 2 additional locations
  • .github/workflows/test-integrations-ai.yml:25
  • .github/workflows/test-integrations-network.yml:26

Identified by Warden · code-review · 8FW-FWB

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-mcp.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
Comment thread
sentry-warden[bot] marked this conversation as resolved.
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-misc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-network.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,10 @@
# 3.6/3.7 run in the python:X.Y container; tell uv to use that system Python.
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
Comment thread
sentry-warden[bot] marked this conversation as resolved.
steps:

Check failure on line 26 in .github/workflows/test-integrations-network.yml

View check run for this annotation

@sentry/warden / warden: code-review

[8FW-FWB] actions/checkout updated to non-existent major version v7.0.1 (additional location) 

The pinned `actions/checkout` commit claims v7.0.1, a version that does not exist in the official repository, indicating a likely supply-chain compromise or bot misconfiguration that will break all affected CI workflows.
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test-integrations-tasks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,13 +35,13 @@ jobs:
SENTRY_PYTHON_TEST_REDIS_HOST: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'redis' || 'localhost' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
enable-cache: false
- name: Install Java
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5

@cursor cursor Bot Aug 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Invalid setup-java action digest

High Severity

The pinned actions/setup-java digest b6effb05e454b25005698d916606bdc6ffcbf961 does not match the digest this PR documents (03ad4de0992f5dab5e18fcb136590ce7c4a0ac95) and does not resolve to a known commit on actions/setup-java. Jobs that install Java via this pin, including the tasks integration workflow, will fail when GitHub Actions cannot fetch the action.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit b59bcb4. Configure here.

with:
distribution: 'temurin'
java-version: '21'
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test-integrations-web-1.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
os: [ubuntu-22.04]
services:
postgres:
image: ghcr.io/getsentry/image-mirror-library-postgres:17-alpine
image: ghcr.io/getsentry/image-mirror-library-postgres:18-alpine

Check failure on line 24 in .github/workflows/test-integrations-web-1.yml

View check run for this annotation

@sentry/warden / warden: code-review

Workflow references non-existent PostgreSQL 18 service image 

The postgres image tag `18-alpine` does not correspond to any released PostgreSQL version and will cause workflow jobs to fail when the runner cannot pull the container.
Comment thread
sentry-warden[bot] marked this conversation as resolved.
env:
POSTGRES_PASSWORD: sentry
# Set health checks to wait until postgres has started
Expand All @@ -41,9 +41,9 @@
SENTRY_PYTHON_TEST_POSTGRES_PASSWORD: sentry
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-web-2.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,9 +98,9 @@ jobs:
if: ${{ !cancelled() }}
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
- name: Download coverage data
# Artifacts from the reusable test workflows live in this same run.
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
Expand All @@ -115,7 +115,7 @@ jobs:
uv run coverage combine .coverage-sentry-*
uv run coverage xml
- name: Report coverage and test results
uses: getsentry/codecov-action@d90e69cdf071dfbb0430159125321dc09c424d4c # main
uses: getsentry/codecov-action@66554aa51d8656c657e233a9e98bcb18e95f2c9a # main
Comment thread
sentry-warden[bot] marked this conversation as resolved.
with:
token: ${{ secrets.GITHUB_TOKEN }}
files: coverage.xml
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/update-tox.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,12 @@ jobs:

steps:
- name: Checkout repo
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
token: ${{ secrets.GITHUB_TOKEN }}

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
cache-python: true

Comment thread
sentry-warden[bot] marked this conversation as resolved.
Expand Down
8 changes: 4 additions & 4 deletions scripts/split_tox_gh_actions/templates/test_group.jinja
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
{% endif %}
{% if needs_postgres %}
postgres:
image: ghcr.io/getsentry/image-mirror-library-postgres:17-alpine
image: ghcr.io/getsentry/image-mirror-library-postgres:18-alpine
Comment thread
sentry-warden[bot] marked this conversation as resolved.
env:
POSTGRES_PASSWORD: sentry
Comment thread
sentry-warden[bot] marked this conversation as resolved.
# Set health checks to wait until postgres has started
Expand Down Expand Up @@ -72,9 +72,9 @@
{% endif %}
container: {% raw %}${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}{% endraw %}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
with:
Comment thread
sentry-warden[bot] marked this conversation as resolved.
enable-cache: false

Expand All @@ -85,7 +85,7 @@

{% if needs_java %}
- name: Install Java
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
with:
distribution: 'temurin'
java-version: '21'
Expand Down
Loading
Loading