Update github actions (main) (patch)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
actions/cache	action	patch	v5.0.4 → v5.0.5
actions/checkout	action	patch	v6.0.2 → v6.0.3
codecov/codecov-action	action	patch	v5.5.4 → v5.5.5
peter-evans/create-pull-request	action	patch	v8.1.0 → v8.1.1

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

actions/cache (actions/cache)

v5.0.5

Compare Source

What's Changed

• Update ts-http-runtime dependency by @​yacaovsnc in #​1747

Full Changelog: actions/cache@v5...v5.0.5

actions/checkout (actions/checkout)

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

codecov/codecov-action (codecov/codecov-action)

v5.5.5

Compare Source

This release only contains the keybase.io change as described here.

Full Changelog: codecov/codecov-action@v5.5.4...v5.5.5

peter-evans/create-pull-request (peter-evans/create-pull-request)

v8.1.1: Create Pull Request v8.1.1

Compare Source

What's Changed

• build(deps-dev): bump the npm group with 2 updates by @​dependabot[bot] in #​4305
• build(deps): bump minimatch by @​dependabot[bot] in #​4311
• build(deps): bump the github-actions group with 2 updates by @​dependabot[bot] in #​4316
• build(deps): bump @​tootallnate/once and jest-environment-jsdom by @​dependabot[bot] in #​4323
• build(deps-dev): bump undici from 6.23.0 to 6.24.0 by @​dependabot[bot] in #​4328
• build(deps-dev): bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​4334
• build(deps): bump picomatch by @​dependabot[bot] in #​4339
• build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by @​dependabot[bot] in #​4344
• build(deps-dev): bump the npm group with 3 updates by @​dependabot[bot] in #​4349
• fix: retry post-creation API calls on 422 eventual consistency errors by @​peter-evans in #​4356

Full Changelog: peter-evans/create-pull-request@v8.1.0...v8.1.1

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	53.47% <ø> (ø)
generative	17.35% <ø> (ø)
integration	28.63% <ø> (ø)
unit	71.80% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Review

Verdict: ✅ Approve

Automated patch-level update of 4 GitHub Actions dependencies across 6 workflow files, generated by Renovate (MintMaker). All changes are SHA-pin bumps with corresponding version comments — no workflow logic or configuration changes.

Updates verified

Action	Old version	New version	SHA verified
actions/checkout	v6.0.2	v6.0.3	✅
actions/cache	v5.0.4	v5.0.5	✅
codecov/codecov-action	v5.5.4	v5.5.5	✅
peter-evans/create-pull-request	v8.1.0	v8.1.1	✅

Verification details

• SHA pin integrity: All 4 action SHAs were independently verified against their upstream Git tags (including annotated tag dereferencing for actions/checkout and codecov/codecov-action). Each SHA in the diff matches the commit pointed to by the claimed version tag.
• Completeness: All 21 instances of these actions across .github/workflows/ are updated — no stale references remain.
• Scope: Changes are confined to .github/workflows/ YAML files. No source code, configuration, or documentation files were modified.
• Release notes: All updates are routine maintenance — dependency bumps, bug fixes (checkout SHA-256 repo support, codecov keybase.io change, create-pull-request 422 retry), and build dependency updates. No breaking changes or new features.

No findings.

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• .github/workflows/checks-codecov.yaml
• .github/workflows/codeql.yaml
• .github/workflows/lint.yaml
• .github/workflows/release.yaml
• .github/workflows/scorecard.yml
• .github/workflows/update-go-containerregistry.yaml

Previous run

Looks good to me — routine patch-level GitHub Actions version bumps via Renovate. All files are under .github/ (protected path); human approval is required per repository policy.

Previous run (2)

Review

Findings

High

• [protected-path] .github/workflows/ — All 6 modified files are under the .github/ protected path. This PR has no linked issue to authorize changes to governance/infrastructure files. Affected files: .github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/release.yaml, .github/workflows/scorecard.yml, .github/workflows/update-go-containerregistry.yaml. Human approval is required for protected-path changes.
  Remediation: A maintainer should review and approve this automated dependency update. The changes themselves are mechanical patch-version bumps of pinned GitHub Actions (actions/cache v5.0.4→v5.0.5, actions/checkout v6.0.2→v6.0.3, codecov/codecov-action v5.5.4→v5.5.5, peter-evans/create-pull-request v8.1.0→v8.1.1) with no behavioral or permission changes.

---

Labels: All changes are to GitHub Actions workflow files.

Previous run (3)

Review

Findings

High

• [protected-path] .github/workflows/ — All 6 changed files are under .github/, a protected path. This PR has no linked issue providing authorization for modifying governance/infrastructure files. While the change is an automated Renovate patch version bump (actions/cache v5.0.4→v5.0.5, actions/checkout v6.0.2→v6.0.3, codecov/codecov-action v5.5.4→v5.5.5, peter-evans/create-pull-request v8.1.0→v8.1.1) and the diff contains only commit SHA pin updates with no permission, trigger, or secrets changes, human approval is required for all protected-path modifications.
  Remediation: A human reviewer must approve this PR. The changes themselves are mechanically correct — all actions remain pinned by full commit SHA, no permissions or workflow triggers were modified.

Info

• [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model unavailable on vertex deployment. For this mechanical version bump, the sub-agent would have triggered early-exit criteria (no style findings expected).

Previous run (4)

Review

Findings

High

• [protected-path] .github/workflows/ — All 6 changed files are under the .github/ protected path (checks-codecov.yaml, codeql.yaml, lint.yaml, release.yaml, scorecard.yml, update-go-containerregistry.yaml). This PR has no linked issue justifying the modification of governance/infrastructure files. Human approval is required for all protected-path changes.

Info

• [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model claude-sonnet-4-5@20250929 is not available. This is a low-risk gap for a mechanical version-bump PR.

The code changes themselves are a straightforward, mechanical Renovate bot update of four GitHub Actions to their latest patch versions (actions/cache v5.0.4 → v5.0.5, actions/checkout v6.0.2 → v6.0.3, codecov/codecov-action v5.5.4 → v5.5.5, peter-evans/create-pull-request v8.1.0 → v8.1.1). All SHA pins are consistent across workflow files, no permissions or secrets handling changed, and no new injection surfaces were introduced. The correctness and security sub-agents found no issues.

Previous run (5)

Review

Findings

High

• [protected-path] .github/workflows/ — All 6 modified files are under .github/, a protected path. This PR has no linked issue authorizing changes to governance/infrastructure files. While the changes are automated Renovate patch-level version bumps (actions/checkout v6.0.2→v6.0.3, actions/cache v5.0.4→v5.0.5, codecov/codecov-action v5.5.4→v5.5.5, peter-evans/create-pull-request v8.1.0→v8.1.1) and the code changes themselves are correct and safe (verified: no permission changes, no structural workflow changes, no new secrets, SHA-pinning preserved), human approval is required for all protected-path modifications.
  Remediation: A human maintainer must review and approve this PR. The version bumps themselves are mechanically correct.

Info

• [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model claude-sonnet-4-5@20250929 not available on vertex deployment. This sub-agent would have early-exited with no findings for this mechanical version-bump PR.

Previous run (6)

Review

Findings

High

• [protected-path] .github/workflows/ — All 6 changed files are under the .github/ protected path (checks-codecov.yaml, codeql.yaml, lint.yaml, release.yaml, scorecard.yml, update-go-containerregistry.yaml). The PR has no linked issue providing authorization for modifying governance/infrastructure files. Human approval is required for all protected-path changes.
  Remediation: A human reviewer with appropriate permissions must approve this PR. Consider linking a tracking issue that authorizes CI dependency updates.

Info

• [supply-chain-verification] .github/workflows/checks-codecov.yaml — The PR bumps three GitHub Actions to new patch versions (actions/checkout v6.0.2→v6.0.3, actions/cache v5.0.4→v5.0.5, peter-evans/create-pull-request v8.1.0→v8.1.1) using full SHA pins. All instances across all 6 workflow files are consistently updated. No permissions, run steps, or workflow structure changes are introduced. SHA-to-tag mappings should be verified against upstream GitHub releases.

• [sub-agent-failure] N/A — The style-conventions and intent-coherence sub-agents did not return findings: model claude-sonnet-4-5@20250929 is not available on the deployment. These are sonnet-tier (non-blocking) dimensions; correctness and security reviews completed successfully.

Previous run (7)

Review

Findings

Medium

• [protected-path] .github/workflows/ — All 6 modified files are under the .github/ protected path. This is an automated Renovate patch-version bump (actions/cache v5.0.4→v5.0.5, actions/checkout v6.0.2→v6.0.3, peter-evans/create-pull-request v8.1.0→v8.1.1) with clear rationale, but human approval is always required for protected-path changes regardless of context.

Info

• [sub-agent-failure] N/A — The style-conventions sub-agent did not return findings: model claude-sonnet-4-5@20250929 is not available on the deployment. This dimension is non-critical for a SHA-pin-only dependency update.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:57 AM UTC · Completed 1:01 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:20 AM UTC · Completed 1:26 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:47 AM UTC · Completed 1:53 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:40 AM UTC · Completed 1:47 AM UTC
Commit: 47d3320 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:43 AM UTC · Completed 1:50 AM UTC
Commit: 47d3320 · View workflow run →

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:49 AM UTC · Completed 1:53 AM UTC
Commit: 7c8ccca · View workflow run →