🚨 Update github actions to v7 (main)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v6.1.0 → v7.0.1
actions/upload-artifact	action	major	v6.0.0 → v7.0.1

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

actions/upload-artifact (actions/upload-artifact)

v7.0.1

Compare Source

What's Changed

• Update the readme with direct upload details by @​danwkennedy in #​795
• Readme: bump all the example versions to v7 by @​danwkennedy in #​796
• Include changes in typespec/ts-http-runtime 0.3.5 by @​yacaovsnc in #​797

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

• Add proxy integration test by @​Link- in #​754
• Upgrade the module to ESM and bump dependencies by @​danwkennedy in #​762
• Support direct file uploads by @​danwkennedy in #​764

New Contributors

• @​Link- made their first contribution in #​754

Full Changelog: actions/upload-artifact@v6...v7.0.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:15 AM UTC · Completed 10:20 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Review

Renovate PR bumping two GitHub Actions to v7 in .github/workflows/scorecards.yml:

• actions/checkout v6.1.0 → v7.0.1
• actions/upload-artifact v6.0.0 → v7.0.1

Both actions remain SHA-pinned with # vX.Y.Z comments preserved. The workflow only fires on push to main, branch_protection_rule, and a schedule; there is no pull_request_target trigger and no interpolation of PR-controlled inputs, so the v7 upgrade does not open new fork-injection surface. Job permissions (security-events: write, id-token: write, contents: read, actions: read) are unchanged.

Note that actions/upload-artifact@v7 is ESM-only and adds direct single-file upload support; this workflow uploads a single results.sarif, which the v7 API still handles.

Findings

Medium

• [protected-path] .github/workflows/scorecards.yml — PR modifies a governance/infrastructure file under .github/. Human approval is always required for protected-path changes, regardless of context. The PR body documents the two action bumps with release notes and preserves SHA pinning, so sufficient rationale is present — but a human reviewer must still explicitly approve.
  Remediation: Human reviewer approval required for the protected-path change.

Info

• [scope-authorization-implicit] N/A — Authorization inferred from the mechanical nature of the change (Renovate SHA/version bump for actions/checkout and actions/upload-artifact from v6 to v7). No architectural review required.
• [provenance-warning] N/A — Prior review context discarded: provenance validation returned unverifiable-wrong-app (prior review comment was created by a different app than expected). This run treats all findings as first-time assessments; severity anchoring was skipped.

Previous run

Review

Findings

Medium

• [protected-path] .github/workflows/scorecards.yml — This PR modifies a governance/infrastructure file under the protected path .github/. Renovate is authorized to keep GitHub Actions up to date in this repo via renovate.json, and the PR description explains the update (actions/checkout v6.1.0 → v7.0.1 and actions/upload-artifact v6.0.0 → v7.0.1). Both pinned SHAs were verified to match the claimed v7.0.1 tags upstream. Even with clear context, human approval is always required for protected-path changes.
  Remediation: Have a human reviewer confirm the version bumps and merge; no code-level change is required.

Previous run (2)

Review

Findings

Medium

• [protected-path] .github/workflows/scorecards.yml — This PR modifies a file under .github/, which is on the repository's protected-paths list. The PR description explains the rationale (Renovate-managed dependency bump of actions/checkout and actions/upload-artifact to v7.0.1, with upstream changelogs quoted). Human approval is always required for protected-path changes, regardless of context.
  Remediation: Have a human reviewer confirm the workflow change is acceptable before merge.

Info

• [provenance-warning] — Prior review context was discarded: provenance validation failed with PRIOR_REVIEW_PROVENANCE=unverifiable-wrong-app (the prior review comment was created by a different app than expected). This run treats all findings as first-time assessments; severity anchoring was skipped.
• [supply-chain-verification] .github/workflows/scorecards.yml — Both new pinned commit SHAs were independently verified against upstream tags: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 matches the v7.0.1 tag target in actions/checkout, and actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a matches the v7.0.1 tag target in actions/upload-artifact. The SHA + # vX.Y.Z pinning convention is preserved. Workflow permissions:, triggers, and secrets exposure are unchanged.

Previous run (3)

Review

Findings

High

• [protected-path] .github/workflows/scorecards.yml — This PR modifies a file under the protected path .github/. The PR has no linked issue providing explicit authorization for modifying governance or infrastructure files. Human approval is required for protected-path changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (4)

Review — Approve ✅

Summary

This Renovate bot PR updates two GitHub Actions in .github/workflows/scorecards.yml from v6 to v7 (major version bumps):

Action	Old Version	New Version
actions/checkout	v6.0.2 (de0fac2...)	v7.0.1 (3d3c42e...)
actions/upload-artifact	v6.0.0 (b7c566a...)	v7.0.1 (043fb46...)

Verification

• ✅ SHA integrity: Both commit SHAs verified against their respective GitHub tags via the GitHub API — they match the claimed versions exactly.
• ✅ Official actions: Both are first-party GitHub Actions from the actions organization.
• ✅ Pin format: Actions remain pinned to full commit SHAs with version comments, following supply-chain security best practices.

Breaking Change Analysis

• actions/checkout v7: Key change is blocking fork PR checkout for pull_request_target and workflow_run events. This workflow only triggers on branch_protection_rule, schedule, and push — not affected.
• actions/upload-artifact v7: Adds optional archive parameter for direct file uploads (defaults to true, backward compatible) and ESM upgrade. The workflow's existing usage of name, path, and retention-days inputs is fully compatible.

Dimensions Reviewed

Dimension	Result
Correctness	✅ Version pins are accurate; workflow inputs are compatible with v7
Security	✅ Full SHA pinning maintained; official actions; checkout v7 adds security hardening
Intent & coherence	✅ Standard automated dependency update, appropriately scoped
Style/conventions	✅ Follows existing @<sha> # v<version> format
Documentation	✅ No documentation impact for CI config changes
Cross-repo contracts	✅ No external API or interface changes

No findings above the reporting threshold.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• .github/workflows/scorecards.yml

Previous run (5)

Review — approve

PR: #233 — 🚨 Update github actions to v7 (main)
Author: renovate[bot]
Scope: 1 file changed (.github/workflows/scorecards.yml), 2 additions, 2 deletions

Summary

This PR updates two SHA-pinned GitHub Actions in the OpenSSF Scorecard workflow from v6 to v7:

Action	Old	New
actions/checkout	v6.0.2 (de0fac2e...)	v7.0.0 (9c091bb2...)
actions/upload-artifact	v6.0.0 (b7c566a7...)	v7.0.1 (043fb46d...)

Dimension results

Dimension	Result
Correctness	✅ No issues — SHA pins verified against GitHub API; both resolve to claimed tags. No breaking changes affect this workflow's triggers (push/schedule/branch_protection_rule) or inputs (persist-credentials: false, name/path/retention-days).
Security	✅ No issues — Permissions block unchanged (read-all top-level, scoped job permissions). No injection surfaces (no expression interpolation of user-controlled inputs). persist-credentials: false retained. actions/checkout v7's fork-blocking change is not relevant (workflow does not use pull_request_target or workflow_run).
Intent & coherence	✅ Mechanical dependency bump by Renovate bot — authorization implicit.
Style & conventions	✅ New lines follow the existing owner/action@full-sha # version-comment pinning pattern.
Docs currency	✅ CI workflow change — no documentation impact.
Cross-repo contracts	⏭ Skipped — no exported interfaces modified.

Verdict

Approve. Clean, mechanical dependency version bump. Both SHA pins are verified authentic, no breaking changes affect this workflow, and permissions are unchanged.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• .github/workflows/scorecards.yml

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:54 PM UTC · Completed 6:57 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 4:50 PM UTC · Completed 5:02 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.45

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Small mechanical GitHub Actions version bump in a CI workflow file by renovate[bot]; single file, low churn, no security-sensitive interpolation, but protected-path (.github/) and CI-workflow signals elevate the composite from 1 to 2.

Previous run

Risk Assessment: moderate (2/5)

Details

Tiny bot-authored Renovate bump to a CI workflow file under a protected path elevates from trivial to moderate despite the 4-line diff.

Previous run (2)

Risk Assessment: moderate (2/5)

Details

Bot-authored major version bump (v6 to v7) of GitHub Actions in a CI workflow. Single file, 4 lines changed. CI workflow change and protected path signals elevate risk slightly above minimal. File has been stable with no churn or regressions in 90 days. Overall low-moderate risk typical of automated dependency updates.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:44 PM UTC · Completed 2:49 PM UTC

Commit: ca5794c · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.17

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 10:22 PM UTC · Completed 10:28 PM UTC

Commit: 4ad3612 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.46

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: bb3521d5-c885-4a7f-bf13-358c80c266ca

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:41 PM UTC · Completed 9:47 PM UTC

Commit: cd01138 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.13