Repository navigation
chore(deps): update setuptools and the pinned GitHub Actions - #85
Merged
Paymaun (digimaun) merged 4 commits intoOct 27, 2026
Merged
Conversation
Pin the wheel hash, the only file that the hashed, binary only installs use. Version 84.1.0 includes the fix for GHSA-xmj3-9gf7-h52w.
…o 8.0.2 Update every pinned reference and the reviewed pins in the workflow and attestation check tests. Both commit SHAs match the release tags.
Move both steps together, because analyze refuses a configuration that a different init version wrote. The commit SHA matches the release tag.
The release adds optional inputs and keeps existing behavior. The commit SHA matches the release tag.
There was a problem hiding this comment.
🔵 Needs a closer look
Updated actions serve release, fleet, and E2E workflows outside pull request CI, leaving runtime validation for human review.
No open issues 🎉
What changed in this PR
Updates build and automation dependencies for Site Ops and Scale Kit, consolidating the linked Dependabot updates while keeping workflow pins and test expectations aligned.
Changes:
- Updates setuptools to 84.1.0 with its wheel hash, incorporating the cited security fix.
- Refreshes artifact and Azure login action pins across CI, deployment, and release workflows.
- Updates CodeQL init and analyze together to 4.39.0 and synchronizes dependency-pin assertions.
| File | Description |
|---|---|
tests/test_distribution_workflows.py |
Updates expected artifact action pins. |
tests/test_distribution_builder.py |
Updates the expected setuptools version. |
tests/test_attestation_check.py |
Aligns attestation workflow pin assertions. |
scripts/siteops-build-requirements.txt |
Updates setuptools and its wheel hash. |
.github/workflows/release.yaml |
Updates release artifact downloads. |
.github/workflows/integration-test.yaml |
Updates Azure login and results upload actions. |
.github/workflows/e2e-test.yaml |
Updates authentication and artifact actions. |
.github/workflows/codeql.yaml |
Updates init and analyze to matching pins. |
.github/workflows/ci.yaml |
Updates the coverage upload action. |
.github/workflows/_workspace-distribution.yaml |
Updates workspace artifact transfers. |
.github/workflows/_siteops-distribution.yaml |
Updates build and attested-asset transfers. |
.github/workflows/_siteops-deploy.yaml |
Updates deployment authentication. |
.github/workflows/_release-candidate.yaml |
Updates candidate artifact transfers. |
.github/workflows/_fleet-reconcile.yaml |
Updates reconciliation authentication and artifacts. |
.github/workflows/_fleet-acceptance.yaml |
Updates fleet authentication and artifact transfers. |
.github/workflows/_attestation-check.yaml |
Updates diagnostic evidence transfers. |
Review effort: Balanced
Sri Harsha Kalavala (shkalavala)
approved these changes
Oct 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates setuptools in the build lock and four pinned GitHub Actions. Each action's commit SHA matches its release tag. The setuptools pin keeps one wheel hash, because every install of the lock is hashed and binary only.
Changes
scripts/siteops-build-requirements.txt. This version includes the fix for GHSA-xmj3-9gf7-h52w.actions/upload-artifact7.0.1 to 7.0.2 andactions/download-artifact8.0.1 to 8.0.2, with the reviewed pins in the workflow and attestation check tests.github/codeql-actioninit and analyze 4.37.9 to 4.39.0, together, because analyze refuses a configuration that a different init version wrote.azure/login3.0.1 to 3.1.0 in the E2E, fleet and integration workflows.Dependabot proposed these one at a time in #84, #74, #73, #70, #69 and #61. The reviewed pin tests and the CodeQL version check need them together, and Dependabot closes those pull requests once the versions are current.
Validation
GitHub Actions CI runs ruff, the unit suite, both bootstrap lanes and CodeQL on the final commit. The workflows that use
azure/loginand the artifact actions for E2E, fleet and release runs are outside pull request CI.