chore(deps): update github workflows by renovate[bot] · Pull Request #6733 · getsentry/sentry-python

renovate · 2026-07-02T12:26:49Z

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout		major	`v6.0.3` → `v7.0.1`
actions/checkout	action	major	`v6.0.3` → `v7.0.1`
actions/setup-java (changelog)		digest	`be666c2` → `b6effb0`
actions/setup-java (changelog)	action	digest	`be666c2` → `b6effb0`
actions/setup-node	action	major	`v6.4.0` → `v7.0.0`
actions/setup-python	action	major	`v6` → `v7`
anthropics/claude-code-action	action	patch	`v1.0.142` → `v1.0.183`
astral-sh/setup-uv		major	`v8.2.0` → `v9.0.0`
astral-sh/setup-uv	action	major	`v8.2.0` → `v9.0.0`
getsentry/action-enforce-license-compliance (changelog)	action	digest	`48236a7` → `d0aa91b`
getsentry/codecov-action (changelog)	action	digest	`d90e69c` → `66554aa`
getsentry/craft	action	minor	`v2.26.9` → `2.28.0`
getsentry/craft (changelog)	action	digest	`6143e76` → `aeb1675`
ghcr.io/getsentry/image-mirror-library-postgres		major	`17-alpine` → `18-alpine`
ghcr.io/getsentry/image-mirror-library-postgres	service	major	`17-alpine` → `18-alpine`
node	uses-with	major	`20` → `24`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

actions/checkout (actions/checkout)

`v7.0.1`

Compare Source

Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #2475
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #2477
Bump docker/build-push-action from 6.5.0 to 7.2.0 by @dependabot[bot] in #2478
Bump docker/login-action from 3.3.0 to 4.2.0 by @dependabot[bot] in #2479
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #2488
Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #2476
eslint 9 by @dependabot[bot] in #2474
Bump the minor-actions-dependencies group with 2 updates by @dependabot[bot] in #2499
skip running unsafe pr check if input is default by @aiqiaoy in #2518
trim only ascii whitespace for branch by @aiqiaoy in #2521
escape values passed to --unset by @aiqiaoy in #2530

`v7.0.0`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v7`

Compare Source

Block checking out fork PR for pull_request_target and workflow_run by @aiqiaoy in #2454
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in #2458
Bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in #2460
Bump js-yaml from 4.1.0 to 4.2.0 by @dependabot[bot] in #2461
Bump @actions/core and @actions/tool-cache and Remove uuid by @dependabot[bot] in #2459
upgrade module to esm and update dependencies by @aiqiaoy in #2463
Bump the minor-npm-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2462

`v6.1.0`

Compare Source

actions/setup-node (actions/setup-node)

`v7.0.0`

Compare Source

What's Changed

Enhancements:

Add cache-primary-key and cache-matched-key as outputs by @gowridurgad in #1577
Migrate to ESM and upgrade dependencies by @gowridurgad in #1574

Bug fixes:

Remove dummy NODE_AUTH_TOKEN export by @gowridurgad in #1558
Only use mirrorToken in getManifest if it's provided by @deiga in #1548

Documentation updates:

Add documentation for publishing to npm with Trusted Publisher (OIDC) by @chiranjib-swain in #1536
docs: Update restore-only cache documentation by @priya-kinthali in #1550
docs: Update caching recommendations to mitigate cache poisoning risks by @chiranjib-swain in #1567

Dependency update:

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in #1569

New Contributors

@chiranjib-swain made their first contribution in #1536
@deiga made their first contribution in #1548
@jasongin made their first contribution in #1569

Full Changelog: actions/setup-node@v6...v7.0.0

`v7`

Compare Source

`v6.5.0`

Compare Source

What's Changed

Update @actions/cache to 5.1.0 and add security overrides for undici and fast-xml-parser by @HarithaVattikuti in #1579

Full Changelog: actions/setup-node@v6.4.0...v6.5.0

actions/setup-python (actions/setup-python)

`v7.0.0`

Compare Source

`v7`

Compare Source

anthropics/claude-code-action (anthropics/claude-code-action)

What's Changed

fix(sanitizer): redact GitHub user-to-server (ghu_) tokens by @NickNojiri in #1502

New Contributors

@NickNojiri made their first contribution in #1502

Full Changelog: anthropics/claude-code-action@v1...v1.0.174

`v1.0.173`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.173

`v1.0.172`

Compare Source

What's Changed

fix(sdk): fail step when result has is_error:true despite success subtype by @syf2211 in #1496

Full Changelog: anthropics/claude-code-action@v1...v1.0.172

`v1.0.171`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.171

`v1.0.170`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.170

`v1.0.169`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.169

`v1.0.168`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.168

`v1.0.167`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.167

`v1.0.166`

Compare Source

What's Changed

Drop buffered inline comment when it is posted live (#1405) by @archievi in #1412
Use modern noreply email for co-author trailers by @tarunag10 in #1369
fix(restore): handle symlinked CLAUDE.md paths during config snapshot by @syf2211 in #1441
fix: preserve repeated add-dir flags in claude args by @Jerry2003826 in #1256
fix: propagate curl failures in install pipeline by @akhilesharora in #1241
chore: fix prettier formatting by @ashwin-ant in #1463

New Contributors

@archievi made their first contribution in #1412
@syf2211 made their first contribution in #1441
@akhilesharora made their first contribution in #1241

Full Changelog: anthropics/claude-code-action@v1...v1.0.166

`v1.0.165`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.165

`v1.0.164`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.164

`v1.0.163`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.163

`v1.0.162`

Compare Source

`v1.0.161`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.161

`v1.0.160`

Compare Source

`v1.0.159`

Compare Source

What's Changed

fix: bound app token revocation cleanup by @tarunag10 in #1437

New Contributors

@tarunag10 made their first contribution in #1437

Full Changelog: anthropics/claude-code-action@v1...v1.0.159

`v1.0.158`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.158

`v1.0.157`

Compare Source

`v1.0.156`

Compare Source

`v1.0.155`

Compare Source

`v1.0.154`

Compare Source

`v1.0.153`

Compare Source

`v1.0.152`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.152

`v1.0.151`

Compare Source

What's Changed

fix: skip workflow validation token exchange failures by @Ryanoonan in #1417

New Contributors

@Ryanoonan made their first contribution in #1417

Full Changelog: anthropics/claude-code-action@v1...v1.0.151

`v1.0.150`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.150

`v1.0.149`

Compare Source

What's Changed

fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:*) rules to bare Bash by @alexglynn in #1350
fix(mcp): align allowed-tools parser with SDK option parser by @bymle in #1373

New Contributors

@alexglynn made their first contribution in #1350

Full Changelog: anthropics/claude-code-action@v1...v1.0.149

`v1.0.148`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.148

`v1.0.147`

Compare Source

What's Changed

Add pr-stamp-sweep review workflow by @ashwin-ant in #1409

Full Changelog: anthropics/claude-code-action@v1...v1.0.147

`v1.0.146`

Compare Source

What's Changed

test: add unit tests for parseGitHubContext and context type guards by @mateuscmtropical in #1404
docs(faq): correct rebase FAQ to match actual behavior by @bymle in #1370
fix: fall back to inherited env for auth when inputs are empty by @kirsanium in #1342
fix: break SDK iterator after result message to prevent hang in pull_request runs by @scobbe in #1339
Pin setup-bun binary for post-steps by @kiwigitops in #1365
fix: clear stale claude-prompts dir before each write by @kyungilpark in #1288
Include labels in formatContext() output for issues and PRs by @joshpayne-joby in #1298
fix(sanitizer): match attribute quotes by type to avoid mangling content by @bymle in #1371
docs: fix execution file parsing example by @looooown2006 in #1297
fix(image-downloader): detect image type from magic bytes, not URL extension by @pmespresso in #1396

New Contributors

@mateuscmtropical made their first contribution in #1404
@bymle made their first contribution in #1370
@kirsanium made their first contribution in #1342
@scobbe made their first contribution in #1339
@kiwigitops made their first contribution in #1365
@kyungilpark made their first contribution in #1288
@joshpayne-joby made their first contribution in #1298
@looooown2006 made their first contribution in #1297
@pmespresso made their first contribution in #1396

Full Changelog: anthropics/claude-code-action@v1...v1.0.146

`v1.0.145`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.145

`v1.0.144`

Compare Source

Full Changelog: anthropics/claude-code-action@v1...v1.0.144

`v1.0.143`

Compare Source

What's Changed

Drop --tsconfig-override from Bun invocations to avoid runtime crash by @chsmc-ant in #1315

New Contributors

@chsmc-ant made their first contribution in #1315

Full Changelog: anthropics/claude-code-action@v1...v1.0.143

astral-sh/setup-uv (astral-sh/setup-uv)

`v9.0.0`

Compare Source

`v8.3.2`

Compare Source

`v8.3.1`

Compare Source

`v8.3.0`

Compare Source

getsentry/craft (getsentry/craft)

`v2.28.0`

Compare Source

New Features ✨

(aws-lambda-layer) Add CompatibleArchitectures and per-region failure improvements by @pabloDeputter in #861

`v2.27.2`

Compare Source

Bug Fixes 🐛

(commit-on-git) Use proper username and pass for by @BYK in #862

`v2.27.1`

Compare Source

Bug Fixes 🐛

(crates) Recognize more already-published error messages by @szokeasaurusrex in #859

`v2.27.0`

Compare Source

New Features ✨

(targets) Add cloudflare deploy target by @BYK in #843
Prefix-aware read paths for monorepo multi-product releases by @BYK in #847

Bug Fixes 🐛

(cloudflare) Default to worker, optional account id, infer prod branch by @BYK in #846
(crates) Ignore dev dependencies when ordering packages by @szokeasaurusrex in #858
Bump postcss to ^8.5.18 (high-severity Dependabot alert) by @BYK in #855
Resolve 9 Dependabot security alerts by @BYK in #854

Documentation 📚

Adopt the Sentry Starlight theme by @sentry-junior in #849

Internal Changes 🔧

Deps Dev

Bump tar from 7.5.16 to 7.5.19 by @dependabot in #852
Bump js-yaml from 4.2.0 to 4.3.0 by @dependabot in #853
Bump shell-quote from 1.8.4 to 1.9.0 by @dependabot in #851

Other

(deps) Bump sharp from 0.33.5 to 0.35.0 in /docs by @dependabot in #850

`v2.26.14`

Compare Source

Bug Fixes 🐛

Deps

Bump js-yaml to >=4.2.0 to resolve GHSA-h67p-54hq-rp68 by @BYK in #841
Bump @babel/core to ^7.29.6 to resolve GHSA-4x5r-pxfx-6jf8 by @BYK in #839

`v2.26.13`

Compare Source

Internal Changes 🔧

Upgrade to Node 24.18.0 (LTS Krypton) by @BYK in #838

`v2.26.12`

Compare Source

Bug Fixes 🐛

Pin Node to 22.23.1 to avoid node-fetch premature-close regression by @BYK in #837

`v2.26.11`

Compare Source

Bug Fixes 🐛

Resolve 10 Dependabot security alerts by @BYK in #836

Internal Changes 🔧

(deps-dev) Bump esbuild from 0.25.12 to 0.28.1 by @dependabot in #834

`v2.26.10`

Compare Source

Bug Fixes 🐛

Bump shell-quote 1.7.3 → ^1.8.4 (GHSA-w7jw-789q-3m8p) by @BYK in #833

actions/node-versions (node)

`v24.18.1`: 24.18.1

Compare Source

Node.js 24.18.1

`v24.18.0`: 24.18.0

Compare Source

Node.js 24.18.0

`v24.17.0`: 24.17.0

Compare Source

Node.js 24.17.0

`v24.16.0`: 24.16.0

Compare Source

Node.js 24.16.0

`v24.15.0`: 24.15.0

Compare Source

Node.js 24.15.0

`v24.14.1`: 24.14.1

Compare Source

Node.js 24.14.1

`v24.14.0`: 24.14.0

Compare Source

Node.js 24.14.0

`v24.13.1`: 24.13.1

Compare Source

Node.js 24.13.1

`v24.13.0`: 24.13.0

Compare Source

Node.js 24.13.0

`v24.12.0`: 24.12.0

Compare Source

Node.js 24.12.0

`v24.11.1`: 24.11.1

Compare Source

Node.js 24.11.1

`v24.11.0`: 24.11.0

Compare Source

Node.js 24.11.0

`v24.10.0`: 24.10.0

Compare Source

Node.js 24.10.0

`v24.9.0`: 24.9.0

Compare Source

Node.js 24.9.0

`v24.8.0`: 24.8.0

Compare Source

Node.js 24.8.0

`v24.7.0`: 24.7.0

Compare Source

Node.js 24.7.0

`v24.6.0`: 24.6.0

Compare Source

Node.js 24.6.0

`v24.5.0`: 24.5.0

Compare Source

Node.js 24.5.0

`v24.4.1`: 24.4.1

Compare Source

Node.js 24.4.1

`v24.4.0`: 24.4.0

Compare Source

Node.js 24.4.0

`v24.3.0`: 24.3.0

Compare Source

Node.js 24.3.0

`v24.2.0`: 24.2.0

Compare Source

Node.js 24.2.0

`v24.1.0`: 24.1.0

Compare Source

Node.js 24.1.0

`v24.0.2`: 24.0.2

Compare Source

Node.js 24.0.2

`v24.0.1`: 24.0.1

Compare Source

Node.js 24.0.1

`v24.0.0`: 24.0.0

Compare Source

Node.js 24.0.0

`v22.23.2`: 22.23.2

Compare Source

Node.js 22.23.2

`v22.23.1`: 22.23.1

Compare Source

Node.js 22.23.1

`v22.23.0`: 22.23.0

Compare Source

Node.js 22.23.0

`v22.22.3`: 22.22.3

Compare Source

Node.js 22.22.3

`v22.22.2`: 22.22.2

Compare Source

Node.js 22.22.2

`v22.22.1`: 22.22.1

Compare Source

Node.js 22.22.1

`v22.22.0`: 22.22.0

Compare Source

Node.js 22.22.0

`v22.21.1`: 22.21.1

Compare Source

Node.js 22.21.1

`v22.21.0`: 22.21.0

Compare Source

Node.js 22.21.0

`v22.20.0`: 22.20.0

Compare Source

Node.js 22.20.0

`v22.19.0`: 22.19.0

Compare Source

Node.js 22.19.0

`v22.18.0`: 22.18.0

Compare Source

Node.js 22.18.0

`v22.17.1`: 22.17.1

Compare Source

Node.js 22.17.1

`v22.17.0`: 22.17.0

Compare Source

Node.js 22.17.0

`v22.16.0`: 22.16.0

Compare Source

Node.js 22.16.0

`v22.15.1`: 22.15.1

Compare Source

Node.js 22.15.1

`v22.15.0`: 22.15.0

Compare Source

Node.js 22.15.0

`v22.14.0`: 22.14.0

Compare Source

Node.js 22.14.0

`v22.13.1`: 22.13.1

Compare Source

Node.js 22.13.1

`v22.13.0`: 22.13.0

Compare Source

Node.js 22.13.0

`v22.12.0`: 22.12.0

Compare Source

Node.js 22.12.0

`v22.11.0`: 22.11.0

Compare Source

Node.js 22.11.0

`v22.10.0`: 22.10.0

Compare Source

Node.js 22.10.0

`v22.9.0`: 22.9.0

Compare Source

Node.js 22.9.0

`v22.8.0`: 22.8.0

Compare Source

Node.js 22.8.0

`v22.7.0`: 22.7.0

Compare Source

Node.js 22.7.0

`v22.6.0`: 22.6.0

Compare Source

Node.js 22.6.0

`v22.5.1`: 22.5.1

Compare Source

Node.js 22.5.1

`v22.5.0`: 22.5.0

Compare Source

Node.js 22.5.0

`v22.4.1`: 22.4.1

Compare Source

Node.js 22.4.1

`v22.4.0`: 22.4.0

Compare Source

Node.js 22.4.0

`v22.3.0`: 22.3.0

Compare Source

Node.js 22.3.0

`v22.2.0`: 22.2.0

Compare Source

Node.js 22.2.0

`v22.1.0`: 22.1.0

Compare Source

Node.js 22.1.0

`v22.0.0`: 22.0.0

Compare Source

Node.js 22.0.0

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-07-02T12:37:55Z

Codecov Results 📊

📊 Comparison with Base Branch

Metric	Change
Total Tests	—
Passed Tests	—
Failed Tests	—
Skipped Tests	—

➕ New Tests (1)

View new tests

test_continuous_profiler_auto_start_and_stop_sampled_span_streaming[experiment-thread]
- File: tests.profiler.test_continuous_profiler
- Status: ❌ Failing

➖ Removed Tests (1)

View removed tests

test_continuous_profiler_auto_start_and_stop_sampled_span_streaming[non-experiment-thread]
- File: tests.profiler.test_continuous_profiler

❌ Failed Tests

`test_continuous_profiler_auto_start_and_stop_sampled_span_streaming[experiment-thread]`

File: tests.profiler.test_continuous_profiler
Suite: py3.7-common
Error: AssertionError: profiler should not be running assert '5cff2546c36e459d8d9c571afd93ab6e' is None + where '5cff2546c36e459d8d9c571afd93ab6e' = get_profiler_id()

Stack Trace

tests/profiler/test_continuous_profiler.py:896: in test_continuous_profiler_auto_start_and_stop_sampled_span_streaming
    assert get_profiler_id() is None, "profiler should not be running"
E   AssertionError: profiler should not be running
E   assert '5cff2546c36e459d8d9c571afd93ab6e' is None
E    +  where '5cff2546c36e459d8d9c571afd93ab6e' = get_profiler_id()

✅ Patch coverage is 100.00%. Project has 2504 uncovered lines.
✅ Project coverage is 89.92%. Comparing base (base) to head (head).

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
+ Coverage    89.88%    89.92%    +0.04%
==========================================
  Files          193       193         —
  Lines        24832     24832         —
  Branches      8912      8912         —
==========================================
+ Hits         22319     22328        +9
- Misses        2513      2504        -9
- Partials      1416      1414        -2

Generated by Codecov Action

sentry-warden · 2026-07-30T15:54:28Z

    container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1


actions/checkout pinned with fabricated v7.0.1 version comment

actions/checkout is pinned to SHA 3d3c42e5aac5ba805825da76410c181273ba90b1 with comment # v7.0.1 across 23 workflow files and 2 Jinja templates. actions/checkout has no v7 release (the latest major release is v4), and the PR body also claims an update from v6.0.3 to v7.0.1, neither of which exist. The version annotation is fabricated, which means the actual commit being checked out is not what the comment claims. Verify the SHA maps to a trustworthy, intentional commit.

Evidence

Every .github/workflows/*.yml file using actions/checkout and both Jinja templates (test_group.jinja, test_orchestrator.jinja) pin the same SHA 3d3c42e5aac5ba805825da76410c181273ba90b1 with comment # v7.0.1 (e.g., .github/workflows/ci.yml:25, .github/workflows/test-integrations-mcp.yml:27).

actions/checkout@v7.0.1 does not exist; the official repository’s latest major release is v4.

The PR body claims an update from v6.0.3 to v7.0.1 for actions/checkout, but v6.0.3 also does not exist.

Renovate is configured in renovate.json to update GitHub Actions, suggesting this was a bot-generated change, but the resulting version comments are clearly invalid.

_{Identified by Warden · code-review, find-bugs · X9B-5C7}

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b59bcb4. Configure here.}

cursor · 2026-08-01T15:18:31Z

          enable-cache: false
      - name: Install Java
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5


Invalid setup-java action digest

High Severity

The pinned actions/setup-java digest b6effb05e454b25005698d916606bdc6ffcbf961 does not match the digest this PR documents (03ad4de0992f5dab5e18fcb136590ce7c4a0ac95) and does not resolve to a known commit on actions/setup-java. Jobs that install Java via this pin, including the tasks integration workflow, will fail when GitHub Actions cannot fetch the action.

Additional Locations (1)

scripts/split_tox_gh_actions/templates/test_group.jinja#L87-L88

^{Reviewed by Cursor Bugbot for commit b59bcb4. Configure here.}

sentry-warden · 2026-08-01T15:32:38Z

@@ -24,9 +24,9 @@ jobs:
      TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
    container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}


actions/checkout v7.0.1 does not exist; all CI workflows reference an unverified SHA

The PR claims to update actions/checkout from v6.0.3 to v7.0.1, but actions/checkout has no published v6 or v7 release (latest stable is v4.x). The pinned SHA 3d3c42e5aac5ba805825da76410c181273ba90b1 is not associated with any known official release. The same impossible-version pattern appears for other actions in the same PR (e.g. actions/upload-artifact v7.0.1, actions/download-artifact v8.0.1, actions/setup-node v7.0.0), indicating systematic version mislabeling. If GitHub cannot resolve the SHA, every workflow will fail at the checkout step.

Evidence

.github/workflows/test-integrations-network.yml:27 contains uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1, which claims a non-existent release.

Every workflow under .github/workflows/*.yml (including ci.yml:25, release.yml:29, test.yml:101) and both Jinja templates (scripts/split_tox_gh_actions/templates/test_group.jinja:75 and test_orchestrator.jinja:55) repeat this exact reference.

Multiple other actions in the PR show the same impossible-version issue, such as actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 in .github/workflows/ci.yml:61 and actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 in .github/workflows/test.yml:106.

actions/checkout latest public release is v4.x; neither v6.0.3 nor v7.0.1 are published releases, so the SHA is unverified.

Also found at 1 additional location

.github/workflows/test-integrations-network.yml:27

_{Identified by Warden · code-review · NV6-F3X}

renovate Bot requested a review from a team as a code owner July 2, 2026 12:26

renovate Bot force-pushed the renovate/github-workflows branch 6 times, most recently from f723b07 to ab7796a Compare July 10, 2026 08:16

renovate Bot force-pushed the renovate/github-workflows branch 8 times, most recently from 4ff0133 to ae76386 Compare July 20, 2026 04:42

cursor Bot reviewed Jul 20, 2026

View reviewed changes

Comment thread .github/workflows/ai-integration-test.yml

renovate Bot force-pushed the renovate/github-workflows branch 3 times, most recently from 64fb4a7 to f8ebb7b Compare July 21, 2026 19:03

sentry-warden Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread .github/workflows/test.yml

sentry-warden Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread .github/workflows/flaky-test-detector.yml

Comment thread .github/workflows/test-integrations-flags.yml

renovate Bot force-pushed the renovate/github-workflows branch 2 times, most recently from 6bc2f74 to 1dcbc62 Compare July 23, 2026 07:41

sentry-warden Bot reviewed Jul 23, 2026

View reviewed changes

Comment thread scripts/split_tox_gh_actions/templates/test_group.jinja

renovate Bot force-pushed the renovate/github-workflows branch from 1dcbc62 to 58362ff Compare July 23, 2026 11:18

sentry-warden Bot reviewed Jul 23, 2026

View reviewed changes

Comment thread .github/workflows/update-tox.yml

sentry-warden Bot reviewed Jul 23, 2026

View reviewed changes

Comment thread .github/workflows/test-integrations-cloud.yml

renovate Bot force-pushed the renovate/github-workflows branch 2 times, most recently from 347bca1 to 3f9c730 Compare July 27, 2026 04:43

sentry-warden Bot reviewed Jul 27, 2026

View reviewed changes

Comment thread .github/workflows/test-integrations-dbs.yml

sentry-warden Bot reviewed Jul 27, 2026

View reviewed changes

Comment thread .github/workflows/ai-integration-test.yml

renovate Bot force-pushed the renovate/github-workflows branch from 3f9c730 to c2a9ecc Compare July 28, 2026 18:23

sentry-warden Bot reviewed Jul 28, 2026

View reviewed changes

Comment thread .github/workflows/test-integrations-web-1.yml

sentry-warden Bot reviewed Jul 28, 2026

View reviewed changes

Comment thread .github/workflows/test-integrations-dbs.yml

renovate Bot force-pushed the renovate/github-workflows branch from c2a9ecc to c39c69d Compare July 29, 2026 10:48

sentry-warden Bot reviewed Jul 29, 2026

View reviewed changes

Comment thread .github/workflows/ci.yml

renovate Bot force-pushed the renovate/github-workflows branch from c39c69d to f67fb98 Compare July 30, 2026 07:22

sentry-warden Bot reviewed Jul 30, 2026

View reviewed changes

Comment thread scripts/split_tox_gh_actions/templates/test_group.jinja

renovate Bot force-pushed the renovate/github-workflows branch 2 times, most recently from 1a1b6cf to d88586b Compare July 30, 2026 14:54

sentry-warden Bot reviewed Jul 30, 2026

View reviewed changes

chore(deps): update github workflows

b59bcb4

renovate Bot force-pushed the renovate/github-workflows branch from d88586b to b59bcb4 Compare August 1, 2026 15:11

cursor Bot reviewed Aug 1, 2026

View reviewed changes

sentry-warden Bot reviewed Aug 1, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update github workflows - #6733

chore(deps): update github workflows#6733
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/github-workflows

renovate Bot commented Jul 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sentry-warden Bot Jul 30, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Aug 1, 2026

Uh oh!

sentry-warden Bot Aug 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

		@@ -24,9 +24,9 @@ jobs:
		TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' \|\| matrix.python-version == '3.7') && 'only-system' \|\| 'managed' }}
		container: ${{ (matrix.python-version == '3.6' \|\| matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) \|\| null }}

Uh oh!

Conversation

renovate Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

Enhancements:

Bug fixes:

Documentation updates:

Dependency update:

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

New Features ✨

Bug Fixes 🐛

Bug Fixes 🐛

New Features ✨

Bug Fixes 🐛

Documentation 📚

Internal Changes 🔧

Deps Dev

Other

Bug Fixes 🐛

Deps

Internal Changes 🔧

Bug Fixes 🐛

Bug Fixes 🐛

Internal Changes 🔧

Bug Fixes 🐛

v24.18.1: 24.18.1

v24.18.0: 24.18.0

v24.17.0: 24.17.0

v24.16.0: 24.16.0

v24.15.0: 24.15.0

v24.14.1: 24.14.1

v24.14.0: 24.14.0

v24.13.1: 24.13.1

v24.13.0: 24.13.0

v24.12.0: 24.12.0

v24.11.1: 24.11.1

v24.11.0: 24.11.0

v24.10.0: 24.10.0

v24.9.0: 24.9.0

v24.8.0: 24.8.0

v24.7.0: 24.7.0

v24.6.0: 24.6.0

v24.5.0: 24.5.0

v24.4.1: 24.4.1

v24.4.0: 24.4.0

v24.3.0: 24.3.0

v24.2.0: 24.2.0

v24.1.0: 24.1.0

v24.0.2: 24.0.2

v24.0.1: 24.0.1

v24.0.0: 24.0.0

v22.23.2: 22.23.2

v22.23.1: 22.23.1

v22.23.0: 22.23.0

v22.22.3: 22.22.3

v22.22.2: 22.22.2

v22.22.1: 22.22.1

v22.22.0: 22.22.0

v22.21.1: 22.21.1

v22.21.0: 22.21.0

v22.20.0: 22.20.0

renovate Bot commented Jul 2, 2026 •

edited

Loading

`v24.18.1`: 24.18.1

`v24.18.0`: 24.18.0

`v24.17.0`: 24.17.0

`v24.16.0`: 24.16.0

`v24.15.0`: 24.15.0

`v24.14.1`: 24.14.1

`v24.14.0`: 24.14.0

`v24.13.1`: 24.13.1

`v24.13.0`: 24.13.0

`v24.12.0`: 24.12.0

`v24.11.1`: 24.11.1

`v24.11.0`: 24.11.0

`v24.10.0`: 24.10.0

`v24.9.0`: 24.9.0

`v24.8.0`: 24.8.0

`v24.7.0`: 24.7.0

`v24.6.0`: 24.6.0

`v24.5.0`: 24.5.0

`v24.4.1`: 24.4.1

`v24.4.0`: 24.4.0

`v24.3.0`: 24.3.0

`v24.2.0`: 24.2.0

`v24.1.0`: 24.1.0

`v24.0.2`: 24.0.2

`v24.0.1`: 24.0.1

`v24.0.0`: 24.0.0

`v22.23.2`: 22.23.2

`v22.23.1`: 22.23.1

`v22.23.0`: 22.23.0

`v22.22.3`: 22.22.3

`v22.22.2`: 22.22.2

`v22.22.1`: 22.22.1

`v22.22.0`: 22.22.0

`v22.21.1`: 22.21.1

`v22.21.0`: 22.21.0

`v22.20.0`: 22.20.0