Update github actions (main) (patch)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
github/codeql-action	action	patch	v4.37.5 → v4.37.7
step-security/harden-runner	action	patch	v2.20.0 → v2.20.1

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

github/codeql-action (github/codeql-action)

v4.37.7

Compare Source

• Update default CodeQL bundle version to 2.26.3. #​4085

v4.37.6

Compare Source

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #​4070

step-security/harden-runner (step-security/harden-runner)

v2.20.1

Compare Source

What's Changed

• AWS CodeBuild-hosted runner support
• Implicitly allow single-labeled (internal) domains in block-mode

Full Changelog: step-security/harden-runner@v2.20.0...v2.20.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:50 AM UTC · Completed 1:58 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [protected-path] .github/workflows/ — All 5 changed files (checks-codecov.yaml, codeql.yaml, lint.yaml, scorecard.yml, website.yaml) are under the protected .github/ path. This Renovate bot PR updates pinned SHA digests for step-security/harden-runner (v2.20.0 → v2.20.1) and github/codeql-action (v4.37.5 → v4.37.7). The version bumps are patch-level and no workflow triggers, permissions, secrets, or run: blocks are modified. However, no linked issue provides justification for modifying governance/infrastructure files. Human approval is required for protected-path changes.
  Remediation: A repository maintainer should verify that the new pinned SHA digests match the expected upstream releases, then approve.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [protected-path] .github/workflows/ — PR modifies 5 files under the protected .github/ path: checks-codecov.yaml, codeql.yaml, lint.yaml, scorecard.yml, website.yaml. The PR has no linked issue authorizing changes to governance/infrastructure files. Human approval is required for protected-path changes.
  Remediation: Obtain human reviewer approval for changes to protected workflow files.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

High

• [protected-path] .github/workflows/ — All 5 changed files are under .github/, a protected path requiring human approval. This PR has no linked issue providing authorization for modifying governance/infrastructure files. Affected files: checks-codecov.yaml, codeql.yaml, lint.yaml, scorecard.yml, website.yaml.
  Remediation: A repository maintainer must review and approve changes to .github/ workflow files. The changes themselves are mechanical patch-version bumps for step-security/harden-runner (v2.20.0 → v2.20.1) and github/codeql-action (v4.37.5 → v4.37.6) with correct SHA pinning — no permissions, triggers, or configuration changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (3)

Review

Findings

High

• [protected-path] .github/workflows/ — All five modified files (checks-codecov.yaml, codeql.yaml, lint.yaml, scorecard.yml, website.yaml) are under the protected .github/ path. This PR has no linked issue providing justification for modifying governance/infrastructure files. While the changes are mechanical patch-level version bumps (step-security/harden-runner v2.20.0 → v2.20.1, github/codeql-action v4.37.5 → v4.37.6) generated by Renovate/MintMaker, human approval is required for all changes to protected paths.
  Remediation: A maintainer should verify the SHA digests correspond to the expected release tags and approve the PR.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (4)

Review

Findings

High

• [protected-path] .github/workflows/ — All 5 changed files (.github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/scorecard.yml, .github/workflows/website.yaml) are under the .github/ protected path. This PR has no linked issue providing explicit authorization for modifying governance/infrastructure files. The changes are routine GitHub Actions digest bumps (step-security/harden-runner v2.20.0 → v2.20.1, github/codeql-action v4.37.5 → v4.37.6) from the red-hat-konflux[bot] automated dependency management bot, and no correctness or security issues were identified in the version updates. Human approval is required for all protected-path changes regardless of content.
  Remediation: A maintainer should review and approve these protected-path changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (5)

Review

Findings

High

• [protected-path] .github/workflows/checks-codecov.yaml — All 5 modified files (.github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/scorecard.yml, .github/workflows/website.yaml) are under the .github/ protected path. The PR has no linked issue authorizing changes to governance/infrastructure files. Human approval is required for all protected-path changes.
  Remediation: Obtain explicit human approval for the protected-path modifications.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (6)

Review

Findings

High

• [protected-path] .github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/scorecard.yml, .github/workflows/website.yaml — All 5 changed files are under the .github/ protected path. This PR modifies GitHub Actions workflow files without a linked issue authorizing the changes. The repository's renovate.json includes the helpers:pinGitHubActionDigests preset, confirming this is an expected Renovate-managed update pattern (step-security/harden-runner v2.20.0 → v2.20.1, github/codeql-action v4.37.5 → v4.37.6). Human approval is always required for protected-path changes, regardless of automation source.
  Remediation: A human reviewer should verify the new action digests correspond to the claimed versions and approve.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (7)

Review

Findings

High

• [protected-path] .github/workflows/codeql.yaml, .github/workflows/scorecard.yml — This PR modifies files under the protected .github/ path. No linked issue provides explicit authorization for changes to governance/infrastructure files. While this is an automated Renovate dependency bump (github/codeql-action v4.37.5 → v4.37.6), human approval is required for all protected-path changes. The changes are a straightforward patch version bump with consistent SHA pinning across all four action references.
  Remediation: A maintainer should review and approve these CI workflow changes.

---

Labels: PR modifies GitHub Actions workflow files under .github/workflows/

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.38% <ø> (ø)
generative	12.28% <ø> (ø)
integration	23.59% <ø> (ø)
unit	72.20% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:02 AM UTC · Completed 2:10 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:57 AM UTC · Completed 4:06 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:58 AM UTC · Completed 3:07 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:03 AM UTC · Completed 1:12 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:51 AM UTC · Completed 3:01 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:58 AM UTC · Completed 2:07 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:03 AM UTC · Completed 2:11 AM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 9:31 PM UTC · Completed 9:37 PM UTC

Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

Retro: PR #3478 — Renovate bot GitHub Actions patch update

Outcome: The workflow functioned correctly but with significant inefficiency. The review agent ran 8 times over 10 days (Aug 8–17) on the same unchanged commit, producing identical [protected-path] CHANGES_REQUESTED findings each time. A human maintainer eventually approved and merged on Aug 18.

What happened

1. Aug 8 — Renovate bot (red-hat-konflux) opened PR Update github actions (main) (patch) #3478 updating SHA pins for step-security/harden-runner (v2.20.0 → v2.20.1) and github/codeql-action (v4.37.5 → v4.37.7) across 5 workflow files. Total diff: 10 additions, 10 deletions — purely mechanical digest swaps.
2. Aug 8–17 — The review agent (run 1, run 2, run 3, run 4, run 5, run 6, run 7, run 8) each submitted CHANGES_REQUESTED with the same protected-path finding. No human engaged with any review until the final approval.
3. Aug 18 — Human maintainer approved and merged.

Assessment

• Token cost: 7 of 8 review runs were pure waste — same commit, same diff, same finding, zero human engagement between runs. Runs were triggered by periodic workflow_dispatch sweeps of open PRs.
• Review quality: The protected-path finding is technically correct but low-value for this class of change. The agent itself noted the changes were "mechanical patch-level version bumps" yet still issued CHANGES_REQUESTED.
• Time to resolution: 10 days for a trivial dependency bump. The repeated CHANGES_REQUESTED reviews added noise without accelerating resolution.
• Autonomy readiness: The human approved without comments, confirming the changes were straightforward. For bot-authored SHA-pin-only updates to workflow files, the review agent's own analysis consistently concluded the changes were safe — yet it could not act on that conclusion.

No new proposals — existing issues cover all findings

All improvement opportunities identified in this retro are already tracked by open issues in fullsend-ai/fullsend:

• Same-commit review dedup (#4681): This PR provides strong additional evidence — 8 runs on commit f219495 with identical output. Also related: #5139, #4022.
• Circuit breaker for unacknowledged reviews (#2992): 8 reviews with zero human engagement until day 10. A cap of 2–3 reviews without human response would have saved 5–6 wasted runs.
• Skip review/retro for bot dependency PRs (#5360): This entire review+retro pipeline was unnecessary for a Renovate patch bump. Also related: #5067, #4989.
• Downgrade protected-path severity for bot PRs (#2588): The agent's own analysis recognized these as mechanical bumps but still issued CHANGES_REQUESTED due to the protected-path policy. Downgrading to COMMENT for bot-authored digest updates would have avoided blocking. Also related: #5370, #2794.

Prioritizing #5360 (skip bot PR review entirely) or #4681 (same-commit dedup) would have the highest impact — either alone would have prevented most of the waste observed here.