chore: bump actions + enable codecov badge - #8
Conversation
…v badge - astral-sh/setup-uv v5 -> v7 - codecov/codecov-action v4 -> v6 - github/codeql-action v3 -> v4 - Re-add codecov badge to README (CODECOV_TOKEN now configured)
📝 WalkthroughWalkthroughThis PR upgrades GitHub Actions dependencies across the CI and CodeQL workflows and adds a Codecov coverage badge to the README. The CI workflow moves from ChangesGitHub Actions and Documentation Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Welcome to Codecov 🎉Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests. ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment Thanks for integrating Codecov - We've got you covered ☂️ |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 18: Replace tag/branch action refs with immutable commit SHAs: update
uses entries like astral-sh/setup-uv@v7, actions/checkout@v6,
codecov/codecov-action@v6, github/codeql-action/init@v4, and
github/codeql-action/analyze@v4 to their corresponding full commit SHA pins (you
can append a comment like "# v7" or "# v6" for readability); ensure every
occurrence of those refs across the workflows is replaced so the actions are
pinned to a specific commit SHA.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: f1303cc8-1fed-48a9-ac1b-dca604d16c43
📒 Files selected for processing (3)
.github/workflows/ci.yml.github/workflows/codeql.ymlREADME.md
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: astral-sh/setup-uv@v5 | ||
| - uses: astral-sh/setup-uv@v7 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify mutable action refs in workflows (tag/branch refs instead of commit SHAs)
rg -nP '^\s*-\s*uses:\s*[^@]+@(v\d+|main|master)\s*$' .github/workflows/*.ymlRepository: Liohtml/MedCheck
Length of output: 851
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== ci.yml (relevant lines) =="
nl -ba .github/workflows/ci.yml | sed -n '1,120p'
echo
echo "== codeql.yml (relevant lines) =="
nl -ba .github/workflows/codeql.yml | sed -n '1,120p'
echo
echo "== All mutable action refs in workflows (tag/branch refs) =="
rg -nP '^\s*-\s*uses:\s*[^@]+@(v\d+|main|master)\s*$' .github/workflows/*.ymlRepository: Liohtml/MedCheck
Length of output: 151
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== ci.yml (relevant lines) =="
nl -ba .github/workflows/ci.yml | sed -n '1,140p'
echo
echo "== codeql.yml (relevant lines) =="
nl -ba .github/workflows/codeql.yml | sed -n '1,120p'
echo
echo "== All mutable action refs in workflows (tag/branch refs) =="
rg -nP '^\s*-\s*uses:\s*[^@]+@(v\d+|main|master)\s*$' .github/workflows/*.ymlRepository: Liohtml/MedCheck
Length of output: 151
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== ci.yml (relevant lines) =="
nl -ba .github/workflows/ci.yml | sed -n '1,160p'
echo
echo "== codeql.yml (relevant lines) =="
nl -ba .github/workflows/codeql.yml | sed -n '1,140p'
echo
echo "== All mutable action refs in workflows (tag/branch refs) =="
rg -nP '^\s*-\s*uses:\s*[^@]+@(v\d+|main|master)\s*$' .github/workflows/*.ymlRepository: Liohtml/MedCheck
Length of output: 151
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
def show(path, start, end):
p = Path(path)
lines = p.read_text().splitlines()
print(f"\n== {path} (lines {start}-{end}) ==")
for i in range(start, min(end, len(lines)) + 1):
print(f"{i:>4}: {lines[i-1]}")
show(".github/workflows/ci.yml", 1, 90)
show(".github/workflows/codeql.yml", 1, 80)
PY
echo
echo "== All mutable action refs in workflows (tag/branch refs) =="
rg -nP '^\s*-\s*uses:\s*[^@]+@(v\d+|main|master)\s*$' .github/workflows/*.ymlRepository: Liohtml/MedCheck
Length of output: 3310
Pin workflow actions to immutable commit SHAs.
Tag/branch-pinned action refs are still used, weakening supply-chain integrity:
.github/workflows/ci.yml:astral-sh/setup-uv@v7(lines 18, 27, 35, 48),actions/checkout@v6(lines 17, 26, 34, 47),codecov/codecov-action@v6(line 53).github/workflows/codeql.yml:actions/checkout@v6(line 15),github/codeql-action/init@v4(line 16),github/codeql-action/analyze@v4(line 19)
Current snippet (line 18)
- uses: astral-sh/setup-uv@v7Pin each uses: to a full commit SHA (you may keep # v7 / # v6 readability comments).
🧰 Tools
🪛 zizmor (1.25.2)
[error] 18-18: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 18, Replace tag/branch action refs with
immutable commit SHAs: update uses entries like astral-sh/setup-uv@v7,
actions/checkout@v6, codecov/codecov-action@v6, github/codeql-action/init@v4,
and github/codeql-action/analyze@v4 to their corresponding full commit SHA pins
(you can append a comment like "# v7" or "# v6" for readability); ensure every
occurrence of those refs across the workflows is replaced so the actions are
pinned to a specific commit SHA.
Changes
astral-sh/setup-uvv5 → v7codecov/codecov-actionv4 → v6github/codeql-actionv3 → v4Resolves the 3 closed dependabot PRs (#3, #4, #5) in one go.
Summary by CodeRabbit
Chores
Documentation