Skip to content

chore(deps): update github-actions - #59

Merged
MarkRedeman merged 1 commit into
mainfrom
renovate/github-actions
Oct 19, 2026
Merged

chore(deps): update github-actions#59
MarkRedeman merged 1 commit into
mainfrom
renovate/github-actions

Conversation

@renovate

@renovate renovate Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
actions/download-artifact action patch v8.0.1 → v8.0.2
actions/upload-artifact action patch v7.0.1 → v7.0.2
astral-sh/setup-uv action minor v10.0.1 → v10.3.0
github/codeql-action action minor v4.37.8 → v4.39.0
j178/prek-action action patch v3.0.0 → v3.0.1
ossf/scorecard-action action minor v2.4.4 → v2.5.0
prek uses-with minor 0.4.0 → v0.5.5
renovatebot/github-action action minor v46.2.4 → v46.3.8
suzuki-shunsuke/github-action-renovate-config-validator action minor v2.1.0 → v2.4.1
trufflesecurity/trufflehog action minor v3.97.0 → v3.99.2

Release Notes

actions/download-artifact

v8.0.2

Compare Source

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v8.0.1...v8.0.2

actions/upload-artifact

v7.0.2

Compare Source

What's Changed

  • Improves artifact download retries when the service returns HTTP 429 (rate limiting), including honoring valid Retry-After headers.
  • Updates @​actions/artifact to v6.3.1.

New Contributors

Full Changelog: actions/upload-artifact@v7.0.1...v7.0.2

astral-sh/setup-uv

v10.3.0: 🌈 Add Python architecture selection

Compare Source

Changes

This release adds the python-arch input to select a Python architecture independently of the Python version. With uv 0.13.0 or later, set python-arch: x86_64 to use x64 Python on Windows ARM64 runners.

It also includes embedded checksums for uv releases through 0.13.0.

🚀 Enhancements

🧰 Maintenance

⬆️ Dependency updates

v10.2.0: 🌈 Disable automatic cache saves for merge queues

Compare Source

Changes

This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

v10.1.0: 🌈 New output python-runtime-idand respect NO_PROXY

Compare Source

Changes

This release adds more bheind the scene security improvements and also 2 small improvements.

NO_PROXY

This action now respects no_proxy/NO_PROXY environment variables which were previously ignored.

New output python-runtime-id

The new output python-runtime-id can be used to know which python version exactly was installed if you use activate-environment. See pyca/cryptography#15572 (comment) for details on why this can be useful.

🐛 Bug fixes

🚀 Enhancements

🧰 Maintenance

📚 Documentation

⬆️ Dependency updates

github/codeql-action

v4.39.0

Compare Source

  • Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
  • The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
  • Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
  • The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198

v4.38.3

Compare Source

  • Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4188
  • Update default CodeQL bundle version to 2.27.2. #​4203
  • Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #​4184

v4.38.2

Compare Source

v4.38.1

Compare Source

  • The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #​4146

v4.38.0

Compare Source

  • On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #​4124
  • The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #​4072
  • Update default CodeQL bundle version to 2.27.0. #​4129

v4.37.9

Compare Source

j178/prek-action

v3.0.1

Compare Source

What's Changed

Full Changelog: j178/prek-action@v3.0.0...v3.0.1

ossf/scorecard-action

v2.5.0

Compare Source

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.

  • The action's container image is built with Go 1.27.2 on a refreshed distroless base. by
    @​justaugustus in #​1716
  • The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still
    recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @​justaugustus in #​1716
  • The Scorecard version in results now always matches the Scorecard release the action is built
    with. by @​justaugustus in #​1718
  • The action no longer prints the GitHub token variable while validating its options. by
    @​arpitjain099 in #​1709
  • results_format accepts intoto, which wraps the JSON results in an in-toto attestation
    statement. by @​puerco in #​1702
Other

New Contributors

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

j178/prek (prek)

v0.5.5: 0.5.5

Compare Source

Release Notes

Released on 2026-10-05.

Enhancements
  • Add Nushell completion generation (#​2785)
  • Add ppc64le wheel and binary builds (#​2809)
Performance
  • Avoid JSON imports when querying Python interpreters (#​2790)
  • Avoid duplicate diffs after hooks rewrite files (#​2815)
  • Batch file reads in shebang checks (#​2793)
  • Check cached hook environments concurrently (#​2797)
  • Overlap Git discovery with worktree status checks (#​2821)
  • Query staged additions only for case conflicts (#​2802)
  • Reduce worker overhead in XML and pygrep checks (#​2789)
  • Reuse Git worktree state during hook startup (#​2787)
  • Reuse intent-to-add paths when saving unstaged changes (#​2788)
  • Run Git queries concurrently for case-conflict checks (#​2792)
  • Share Bun and Deno version queries across environments (#​2795)
  • Share Lua runtime probes across hook environments (#​2796)
  • Share Ruby version queries across hook environments (#​2794)
  • Share mise version queries across hook environments (#​2798)
  • Skip site initialization in Python interpreter probes (#​2822)
  • Skip untracked files in destroyed symlink checks (#​2799)
  • Skip unused file input for always-run hooks (#​2813)
Bug fixes
  • Preserve staged and unstaged changes on conflicted stash restore (#​2803)
  • Default missing core.fileMode in shebang checks (#​2832)
  • Match protected branch patterns from the start (#​2829)
  • Normalize explicit paths in shebang index checks (#​2831)
  • Preserve empty trailing-whitespace character sets (#​2830)
  • Reject empty files in check-json (#​2826)
  • Reject trailing data in check-json (#​2828)
  • Round up file sizes in check-added-large-files (#​2827)
Documentation
  • Redesign the prek badge and refresh logo details (#​2818)
Contributors

Install prek 0.5.5

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.5/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.5/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek

Download prek 0.5.5

File Platform Checksum
prek-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
prek-x86_64-apple-darwin.tar.gz Intel macOS checksum
prek-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
prek-x86_64-pc-windows-msvc.zip x64 Windows checksum
prek-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
prek-powerpc64le-unknown-linux-gnu.tar.gz PPC64LE Linux checksum
prek-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
prek-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
prek-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo j178/prek

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v0.5.4: 0.5.4

Compare Source

Release Notes

Released on 2026-09-28.

Highlights
Faster builtin hooks

In our end-to-end benchmark, prek is about 38% faster than 0.5.3, with some builtin
hooks up to 273% faster (check-yaml: 273%, check-json: 80%,
check-merge-conflict: 71%).

Enhancements
  • Add include_deleted to allow hooks to include deleted files (#​2733)
  • Add --check and simplify end-of-file-fixer (#​2764)
  • Add --check to file-contents-sorter (#​2765)
  • Add --check to requirements-txt-fixer (#​2766)
  • Add --check to trailing-whitespace (#​2763)
  • Expose and document prek util generate-shell-completion (#​2727)
  • Support hide_status in project and user configuration (#​2760)
  • Support look-around regex in builtin pattern hooks (#​2732)
Performance
  • Cache the resolved Git executable on macOS (#​2726)
  • Combine and cache Git repository path queries (#​2724)
  • Optimize common builtin hook execution (#​2768)
  • Optimize scanning in mixed-line-ending and trailing-whitespace (#​2769)
  • Scan check-merge-conflict files in fixed-size blocks (#​2781)
  • Use SIMD UTF-8 validation in check-json, check-toml, and check-yaml (#​2770)
Bug fixes
  • Retry transient rename failures on Windows (#​2756)
  • Use PATH to resolve prek in completion scripts (#​2719)
Documentation
  • Clarify the flow and scope of usage guides (#​2710)
  • Reorganize usage guides and reference documentation (#​2709)
Other changes
Contributors

Install prek 0.5.4

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.4/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.4/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek

Download prek 0.5.4

File Platform Checksum
prek-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
prek-x86_64-apple-darwin.tar.gz Intel macOS checksum
prek-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
prek-x86_64-pc-windows-msvc.zip x64 Windows checksum
prek-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
prek-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
prek-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
prek-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo j178/prek

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v0.5.3: 0.5.3

Compare Source

Release Notes

Released on 2026-09-13.

Enhancements
  • Add PEP 740 attestations for PyPI releases (#​2705)
  • Add a check-jsonc builtin hook (#​2682)
  • Allow disabling automatic uv installation (#​2702)
Bug fixes
  • Fix Julia additional dependency specifiers (#​2703)
  • Update granit-parser to fix YAML flow indentation (#​2707)
Contributors

Install prek 0.5.3

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.3/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.3/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek

Download prek 0.5.3

File Platform Checksum
prek-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
prek-x86_64-apple-darwin.tar.gz Intel macOS checksum
prek-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
prek-x86_64-pc-windows-msvc.zip x64 Windows checksum
prek-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
prek-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
prek-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
prek-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo j178/prek

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v0.5.2: 0.5.2

Compare Source

Release Notes

Released on 2026-09-03.

Enhancements
  • Allow unknown tags by default in check-yaml (#​2678)
Contributors

Install prek 0.5.2

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.2/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.2/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek

Download prek 0.5.2

File Platform Checksum
prek-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
prek-x86_64-apple-darwin.tar.gz Intel macOS checksum
prek-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
prek-x86_64-pc-windows-msvc.zip x64 Windows checksum
prek-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
prek-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
prek-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
prek-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo j178/prek

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v0.5.1: 0.5.1

Compare Source

Release Notes

Released on 2026-09-01.

Enhancements
  • Add --hide-status <passed|failed|skipped> for hook reports (#​2644)
  • Add prek init for repository setup (#​2636)
  • Apply hook env during environment creation (#​2650)
  • Disable error snippets in check-yaml diagnostics (#​2664)
  • Show hooks excluded by skip selectors (#​2645)
  • Support Pixi for Conda environments (#​2667)
  • Support cargo-binstall for Rust CLI dependencies (#​2658)
  • Warn about unused keys in user settings (#​2665)
Bug fixes
  • Reject unsupported YAML tags in check-yaml (#​2656)
Documentation
  • Clarify local hook documentation (#​2640)
  • Clarify pre-commit command compatibility (#​2635)
  • Document automatic PR fixes with autofix.ci (#​2643)
  • Document check-yaml unsafe support (#​2632)
  • Improve setup and workflow documentation (#​2637)
Other changes
  • Drop low-usage release targets (#​2651)
  • Generate a prek manifest JSON schema (#​2648)
Contributors

Install prek 0.5.1

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.1/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.1/prek-installer.ps1 | iex"
Install prebuilt binaries via Homebrew
brew install prek

Download prek 0.5.1

File Platform Checksum
prek-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
prek-x86_64-apple-darwin.tar.gz Intel macOS checksum
prek-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
prek-x86_64-pc-windows-msvc.zip x64 Windows checksum
prek-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
prek-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
prek-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
prek-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo j178/prek

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

v0.5.0: 0.5.0

Compare Source

Release Notes

Released on 2026-08-27.

Highlights
Choose where hook toolchains come from

language_version now accepts a source preference alongside the version
request, letting you control where prek looks for a compatible toolchain when
it creates a hook environment. Use managed (the default) or system to choose
which source prek tries first while still allowing fallback and downloads. Use
only-managed or only-system to require one source.

For example, this local Ruff hook requires a Python 3.12 toolchain managed by
prek:

repos:
  - repo: local
    hooks:
      - id: ruff
        name: ruff
        language: python
        entry: ruff check
        additional_dependencies: [ruff]
        language_version:
          request: "3.12"
          preference: only-managed

With only-managed, prek reuses a compatible toolchain from its managed store
or downloads one when needed. It never falls back to Python from PATH, an OS
package manager, or a version manager, so toolchain selection does not depend on
the developer or CI machine's external environment.

Existing scalar values such as language_version: "3.12" continue to work. See
toolchain management and language_version
for the full source-selection behavior. (#​2613)

Breaking changes

The breaking changes in this release are mostly small cleanups, and most users should not be affected.

  • Group names can no longer start with @. This prefix is now reserved for special group selectors such as the new @ungrouped selector. (#​2617)
  • PREK_MAX_CONCURRENCY has been removed. Use PREK_CONCURRENT_HOOKS and PREK_CONCURRENT_BATCHES to control hook and per-hook batch concurrency separately. (#​2620)
  • The top-level prek init-template-dir command has been removed. Use prek util init-template-dir, or prek init-templatedir for drop-in compatibility with pre-commit. (#​2623)
  • prek auto-update has been removed. Use prek update, or prek autoupdate for drop-in compatibility with pre-commit. (#​2619)
Enhancements
  • Add configurable toolchain source preferences (#​2613)
  • Allow explicit language: python to opt out of fast-path hooks (#​2608)
  • Group run and update options in CLI help (#​2629)
  • Preserve terminal theme contrast for status labels (#​2592)
  • Add @ungrouped group selector (#​2617)
  • Retry uv installation with static musl binary (#​2600)
  • Support {hook_repo} placeholder in hook entry (#​2602)
Bug fixes
  • Expose the git work tree to hooks running outside the git root (#​2579)
  • Isolate local hook environment installation (#​2615)
  • Preserve hook config deserialization error locations (#​2573)
  • Resolve hook log files from their config directory (#​2580)
  • Track explicit config paths as absolute paths (#​2574)
Documentation
  • Document prek run architecture (#​2630)
  • Publish versioned documentation (#​2626)
Contributors

Install prek 0.5.0

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.0/prek-installer.sh | sh
Install prebuilt binaries via powershell script
powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.0/prek-installer.ps1 | iex"
Install prebuilt binaries via Hom

[!IMPORTANT]
✂ PR body was truncated to here.

@renovate
renovate Bot requested a review from MarkRedeman as a code owner August 31, 2026 02:02
@github-actions

github-actions Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ❌ 1 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 1 package(s) with unknown licenses.
See the Details below.

License Issues

.github/workflows/secret-scan.yml

PackageVersionLicenseIssue Type
trufflesecurity/trufflehoge76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9AGPL-3.0Incompatible License

.github/workflows/renovate.yml

PackageVersionLicenseIssue Type
renovatebot/github-actionf0f41e5f2e706165f6814b1d0f0d0e319de7d1d9NullUnknown License
Denied Licenses: GPL-1.0-only, GPL-1.0-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, AGPL-1.0-only, AGPL-1.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later

OpenSSF Scorecard

PackageVersionScoreDetails
actions/renovatebot/github-action f0f41e5f2e706165f6814b1d0f0d0e319de7d1d9 🟢 6.5
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 0/29 approved changesets -- score normalized to 0
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 10SAST tool is run on all commits
actions/trufflesecurity/trufflehog e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9 🟢 7.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 9binaries present in source code
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Packaging🟢 10packaging workflow detected
SAST🟢 10SAST tool is run on all commits

Scanned Files

  • .github/workflows/renovate.yml
  • .github/workflows/secret-scan.yml

@renovate
renovate Bot force-pushed the renovate/github-actions branch 5 times, most recently from d8e53bf to e8cfc51 Compare September 10, 2026 02:59
@renovate
renovate Bot force-pushed the renovate/github-actions branch 7 times, most recently from c7867a2 to c3adecb Compare September 17, 2026 06:31
@renovate
renovate Bot force-pushed the renovate/github-actions branch 5 times, most recently from 6cef8a5 to 33bcd67 Compare September 26, 2026 19:28
@renovate
renovate Bot force-pushed the renovate/github-actions branch 6 times, most recently from 1b7d8fb to bd376e0 Compare October 2, 2026 16:30
@renovate
renovate Bot force-pushed the renovate/github-actions branch 4 times, most recently from 9907ab4 to 86355df Compare October 8, 2026 15:26
@renovate
renovate Bot force-pushed the renovate/github-actions branch 8 times, most recently from e9698c4 to bbeb768 Compare October 15, 2026 05:03
@renovate
renovate Bot force-pushed the renovate/github-actions branch from bbeb768 to d032bd2 Compare October 18, 2026 12:59
@MarkRedeman
MarkRedeman merged commit 1263d83 into main Oct 19, 2026
11 of 13 checks passed
@MarkRedeman
MarkRedeman deleted the renovate/github-actions branch October 19, 2026 07:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@MarkRedeman MarkRedeman Awaiting requested review from MarkRedeman MarkRedeman is a code owner

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@MarkRedeman