[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change	Pending
conforma/github-workflows (changelog)	action	digest	837d70f → cc8da96
conforma/github-workflows (changelog)	workflow	digest	837d70f → cc8da96
github/codeql-action	action	minor	v4.38.2 → v4.39.3
ossf/scorecard-action	action	minor	v2.4.4 → v2.5.0
step-security/harden-runner	action	minor	v2.21.1 → v2.22.3	v2.22.4

---

Release Notes

github/codeql-action (github/codeql-action)

v4.39.3

Compare Source

• Fixed diff-informed alert filtering incorrectly removing alerts in changed files whose paths contain spaces, special characters, or non-ASCII characters. #​4283

v4.39.2

Compare Source

• Update default CodeQL bundle version to 2.27.4. #​4284
• Upcoming breaking change: CodeQL version 2.22.3 and earlier were discontinued on 16 October 2026 alongside GitHub Enterprise Server 3.18, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4266
• Starting with macOS 27 and Xcode 27, traced analyses are unsupported. See this blog post for more information. The CodeQL Action will now try to identify if a workflow is about to perform a traced analysis on version 27 or above of macOS or Xcode. If so, the CodeQL Action will emit a corresponding warning that will also be visible on the Tool Status Page. This check will be rolled out following this release of the CodeQL Action. #​4221
• The undocumented TRAP cache cleanup feature that could be enabled using the CODEQL_ACTION_CLEANUP_TRAP_CACHES environment variable has been removed, as announced in the release notes for CodeQL Action 4.35.2. The analyze Action now warns if this environment variable is set. If you used TRAP cache cleanup to limit Actions cache usage, we recommend disabling TRAP caching by passing the trap-caching: false input to the init Action. #​4243

v4.39.1

Compare Source

• Update default CodeQL bundle version to 2.27.3. #​4256

v4.39.0

Compare Source

• Breaking change: Bump the minimum required CodeQL bundle version to 2.20.7. #​4205
• The codeql-action/analyze step now validates that a correct argument for the checkout_path input has been provided. The checkout_path input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by codeql-action/init, then the CodeQL Action now produces a warning. #​4148
• Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. #​4206
• The codeql-action/start-proxy step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as codeql-action/init. This primarily benefits customers who are using GitHub instances other than github.com where the codeql-action/start-proxy step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. #​4198

v4.38.3

Compare Source

• Upcoming breaking change: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. #​4188
• Update default CodeQL bundle version to 2.27.2. #​4203
• Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. #​4184

ossf/scorecard-action (ossf/scorecard-action)

v2.5.0

Compare Source

What's Changed

This release moves the action to Scorecard v5.6.0, the first Scorecard release since its hosted
services moved to new infrastructure.

For changes to checks and results, and what the infrastructure move means for you, see the
Scorecard v5.6.0 release notes.

• The action's container image is built with Go 1.27.2 on a refreshed distroless base. by
  @​justaugustus in #​1716
• The installer (cmd/installer) now creates .github/workflows/scorecard.yml, and still
  recognizes existing scorecards.yml and scorecards-analysis.yml workflows. by @​justaugustus in #​1716
• The Scorecard version in results now always matches the Scorecard release the action is built
  with. by @​justaugustus in #​1718
• The action no longer prints the GitHub token variable while validating its options. by
  @​arpitjain099 in #​1709
• results_format accepts intoto, which wraps the JSON results in an in-toto attestation
  statement. by @​puerco in #​1702

Other

• Add a daily canary against Scorecard main by @​justaugustus in #​1711
• Bump Scorecard to the v5.6.0 candidate and fix the canary toolchain by @​justaugustus in #​1714
• Run Scorecard on every merge, add a zizmor presubmit, analyze workflows with CodeQL, and update
  RELEASE.md by @​justaugustus in #​1716
• Bump Scorecard to v5.6.0 by @​justaugustus in #​1719

New Contributors

• @​arpitjain099 made their first contribution in #​1709
• @​puerco made their first contribution in #​1702

Full Changelog: ossf/scorecard-action@v2.4.4...v2.5.0

step-security/harden-runner (step-security/harden-runner)

v2.22.3

Compare Source

What's Changed

• Added support for Avrea-hosted runners (enterprise tier)
• Fixed unexpected blocking of allowed connections caused by GitHub’s DNS resolver and outbound proxy experiment on GitHub-hosted Linux runners
• Added a feature flag to disable implicit AWS endpoint allowances on self-hosted Linux runners (enterprise tier)

Full Changelog: step-security/harden-runner@v2.22.2...v2.22.3

v2.22.2

Compare Source

What's Changed

• Fixed inbound (ingress) network traffic being incorrectly classified as outbound (egress) traffic on macOS
• Fixed implicit endpoints intended for self-hosted runners being applied to custom VM environments on Linux (enterprise tier)
• Improved network and DNS tracing, enforcement logic, and process information correlation on Linux (enterprise tier)

Full Changelog: step-security/harden-runner@v2.22.1...v2.22.2

v2.22.1

Compare Source

What's Changed

• Fixed security rules not initializing on GHES self-hosted runners
• Fixed GHES connectivity in block mode by implicitly allowing the GHES hostname

Full Changelog: step-security/harden-runner@v2.22.0...v2.22.1

v2.22.0

Compare Source

What's Changed

• Linux ARM64 support for community tier
• GHES support for self-hosted VMs (enterprise tier)
• MacOS and Windows runner deny list support for block policy (enterprise tier).

Full Changelog: step-security/harden-runner@v2.21.1...v2.22.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: bbf77ed
• Latest commit, not reviewed: a4ddf43

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review.

Walkthrough

Changes

Workflow files update pinned GitHub Action references. Harden Runner, CodeQL, and Scorecard versions change, and the auto-merge reusable workflow and Go version check action use new commits.

Workflow action pin updates

Layer / File(s)	Summary
Security and analysis action pins .github/workflows/benchmark.yaml, .github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/release.yaml, .github/workflows/scorecard.yml, .github/workflows/website.yaml	Harden Runner updates to v2.22.1. CodeQL updates to v4.39.0. Scorecard updates to v2.5.0.
Reusable workflow and tool references .github/workflows/auto-merge.yaml, .github/workflows/checks-codecov.yaml	The auto-merge reusable workflow and Go version check action use new commit references.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: bohdanmar, robnester-rh

Merge Risk: Minimal · previous review bbf77

The workflow dependency updates introduce no established compatibility or merge-blocking risk.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies an update to GitHub Actions, which matches the main changes.
Description check		The description provides detailed, relevant information about the dependency updates and release changes. It does not use the template headings or include a ticket, but it is otherwise sufficiently co…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description provides detailed, relevant information about the dependency updates and release changes. It does not use the template headings or include a ticket, but it is otherwise sufficiently complete.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Finishing Touches

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 1003a48c-9160-4d1d-a5ce-2fa1ef82de57

📥 Commits

Reviewing files that changed from the base of the PR and between f89003c and bbf77ed.

📒 Files selected for processing: 2

• .github/workflows/codeql.yaml
• .github/workflows/scorecard.yml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 11 remain after this review.

[fullsend-ai-review]

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Small bot-authored GitHub Actions version bump across 8 CI workflow files; elevated PROTECTED_PATH_COUNT and CI_WORKFLOW_CHANGED scores are offset by routine automated nature, negligible churn, and no security-sensitive changes, yielding a moderate composite risk of ~2.0.

Previous run

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Re-review anchoring confirms prior score of 2 (moderate): all Tier 1 signals unchanged (8 CI workflow files, Renovate bot author, XS size 30 lines, PROTECTED_PATH_COUNT=8, CI_WORKFLOW_CHANGED=true), Tier 2 signals consistent with prior (benchmark.yaml fix-pattern counts are Renovate dep-bump history, not true regressions), weighted composite (Tier1=62%*2.1 + Tier2=38%*1.6 = 1.91) rounds to 2.

Previous run (2)

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Re-review anchoring confirms prior score of 2 (moderate): all Tier 1 signals unchanged (8 CI workflow files, Renovate bot author, XS size 30 lines, PROTECTED_PATH_COUNT=8, CI_WORKFLOW_CHANGED=true), Tier 2 signals consistent with prior (benchmark.yaml fix history is Renovate dep-bump commits, low true churn across all files), weighted composite (Tier1=62%, Tier2=38%) yields 1.98, rounding to 2.

Previous run (3)

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Re-review anchoring confirms prior score of 2 (moderate): all Tier 1 signals unchanged (8 CI workflow files, Renovate bot author, XS size 30 lines, PROTECTED_PATH_COUNT=8, CI_WORKFLOW_CHANGED=true), Tier 2 signals consistent with prior (benchmark.yaml fix/revert history already noted, low churn across all files), weighted composite (Tier1=62%, Tier2=38%) yields 2.08, rounding to 2.

Previous run (4)

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Re-review anchoring confirms prior score of 2 (moderate): all Tier 1 signals unchanged (8 CI workflow files, Renovate bot author, XS size 30 lines, PROTECTED_PATH_COUNT=8, CI_WORKFLOW_CHANGED=true), Tier 2 signals consistent with prior (benchmark.yaml fix/revert history already present, low churn across all files), weighted composite (Tier1=62%, Tier2=38%) yields ~1.91, rounding to 2.

Previous run (5)

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Re-review anchoring confirms prior score of 2 (moderate): all Tier 1 signals unchanged (8 CI workflow files, Renovate bot author, XS size 30 lines, PROTECTED_PATH_COUNT=8, CI_WORKFLOW_CHANGED=true), Tier 2 signals consistent with prior (benchmark.yaml fix/revert history already present), weighted composite (Tier1=62%, Tier2=38%) yields ~1.91, rounding to 2.

Previous run (6)

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Re-review anchoring confirms prior score of 2 (moderate): Tier 1 signals unchanged (same 8 CI workflow files, Renovate bot author, XS size with 30 lines), Tier 2 composite of ~1.57 consistent with benchmark.yaml elevated fix/revert history; weighted composite (Tier1=62%, Tier2=38%) yields 1.91, rounding to 2.

Previous run (7)

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Re-review anchoring confirms prior score of 2 (moderate): Tier 1 signals are unchanged (same 8 CI workflow files, Renovate bot author, XS size with 30 lines), and Tier 2 composite of ~2.86 is consistent with the prior run, with benchmark.yaml retaining elevated fix/revert history; weighted composite (Tier1=62%, Tier2=38%) yields 2.40, rounding to 2.

Previous run (8)

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Re-review anchoring confirms prior score of 2 (moderate): Tier 1 signals unchanged (same 8 CI workflow files, Renovate bot author, XS size), Tier 2 composite of 1.84 is consistent with prior (1.57), with benchmark.yaml retaining elevated fix/revert history but zero recent churn, yielding weighted composite of 2.02 rounding to 2.

Previous run (9)

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Re-review anchoring confirms prior score of 2 (moderate): Tier 1 signals unchanged (same 8 CI workflow files, Renovate bot author, XS size), Tier 2 composite of 1.57 consistent with benchmark.yaml fix/revert history reflecting CI maintenance, yielding weighted composite of 1.91 rounding to 2.

Previous run (10)

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Re-review anchoring confirms prior score of 2 (moderate): Tier 1 signals unchanged (same 8 CI workflow files, Renovate bot author, XS size), Tier 2 composite of 1.57 consistent with benchmark.yaml fix/revert history reflecting CI maintenance, yielding weighted composite of 1.92 rounding to 2.

Previous run (11)

<!-- fullsend:risk-assessment -->
Risk Assessment: moderate (2/5)

Details

Routine Renovate bot SHA-pin update across the same 8 CI workflow files as prior review; unchanged Tier 1 signals and a Tier 2 composite of 1.875 both confirm the prior moderate score of 2, with benchmark.yaml elevated fix/revert history (12 in 90d) reflecting ongoing CI maintenance rather than instability.

Previous run (12)

Risk Assessment: moderate (2/5)

Details

Routine Renovate bot GitHub Actions SHA bump across 8 CI workflow files; low blast radius and bot authorship keep composite risk moderate despite all files being under the protected .github/ path.

Previous run (13)

Risk Assessment: moderate (2/5)

Details

Routine Renovate bot PR updating GitHub Actions versions across 8 CI workflow files; Tier 1 signals identical to prior assessment (elevated PROTECTED_PATH_COUNT and CI_WORKFLOW_CHANGED structural to any CI workflow PR, offset by bot authorship and zero security-sensitive files), Tier 2 git history unchanged, composite 1.92 rounds to 2.

Previous run (14)

Risk Assessment: moderate (2/5)

Details

Routine Renovate bot PR updating GitHub Actions versions across 8 CI workflow files. Tier 1 signals unchanged from prior assessment (2/5 moderate): elevated PROTECTED_PATH_COUNT and CI_WORKFLOW_CHANGED are structural to any CI workflow PR, offset by bot authorship, zero security-sensitive files, and XS line count. Tier 2 regression-history score driven by EC-1818 benchmark feature iterations, not post-ship breakage. Composite 2.30 rounds to 2.

Previous run (15)

Risk Assessment: moderate (2/5)

Details

Routine Renovate bot PR updating GitHub Actions versions across 8 CI workflow files; bot authorship, zero security-sensitive files, and low recent churn offset the elevated protected-path count and CI_WORKFLOW_CHANGED flag, yielding a moderate composite of 2.

[fullsend-ai-review]

Review

Findings

High

• [protected-path] .github/workflows/ — All 8 changed files fall under the protected .github/ path (auto-merge.yaml, benchmark.yaml, checks-codecov.yaml, codeql.yaml, lint.yaml, release.yaml, scorecard.yml, website.yaml). The PR has no linked issue justifying the modification of governance/infrastructure files. Human approval is required for protected-path changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run

Review

Findings

High

• [protected-path] .github/workflows/auto-merge.yaml, .github/workflows/benchmark.yaml, .github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/release.yaml, .github/workflows/scorecard.yml, .github/workflows/website.yaml — All 8 modified files are under the protected .github/ path. This PR has no linked issue explaining why governance/infrastructure files are being changed. Human approval is always required for protected-path changes regardless of context.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (2)

Review

Findings

High

• [protected-path] .github/workflows/ — All 8 modified files (auto-merge.yaml, benchmark.yaml, checks-codecov.yaml, codeql.yaml, lint.yaml, release.yaml, scorecard.yml, website.yaml) are under .github/, a protected path. The PR has no linked issue providing authorization context for modifying governance and infrastructure files. Human approval is required for protected-path changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (3)

Review

Findings

High

• [protected-path] .github/workflows/ (8 files) — All changed files are under the .github/ protected path. The PR has no linked issue providing authorization for modifying governance/infrastructure files. Human approval is always required for protected-path changes. Affected files: auto-merge.yaml, benchmark.yaml, checks-codecov.yaml, codeql.yaml, lint.yaml, release.yaml, scorecard.yml, website.yaml.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (4)

Review

Findings

High

• [protected-path] .github/workflows/* — All 8 changed files are under the protected .github/ path (auto-merge.yaml, benchmark.yaml, checks-codecov.yaml, codeql.yaml, lint.yaml, release.yaml, scorecard.yml, website.yaml). This PR has no linked issue providing justification for modifying governance/infrastructure files. Human approval is required for all protected-path changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (5)

Review

Findings

High

• [protected-path] .github/workflows/ — PR modifies 8 files under the protected .github/ path (.github/workflows/auto-merge.yaml, .github/workflows/benchmark.yaml, .github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/release.yaml, .github/workflows/scorecard.yml, .github/workflows/website.yaml). No linked issue justifies the modifications to governance/infrastructure files. Human approval is required for protected-path changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (6)

Review

Findings

High

• [protected-path] .github/workflows/ — All 8 changed files are under the protected .github/ path (.github/workflows/auto-merge.yaml, .github/workflows/benchmark.yaml, .github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/release.yaml, .github/workflows/scorecard.yml, .github/workflows/website.yaml). This PR has no linked issue justifying modifications to governance/infrastructure files. Human approval is required for all protected-path changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (7)

Review

Findings

High

• [protected-path] .github/workflows/ — All 8 changed files (.github/workflows/auto-merge.yaml, .github/workflows/benchmark.yaml, .github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/release.yaml, .github/workflows/scorecard.yml, .github/workflows/website.yaml) are under the .github/ protected path. This PR has no linked issue justifying changes to governance or infrastructure files. Human approval is required for protected-path changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (8)

Review

Findings

High

• [protected-path] .github/workflows/auto-merge.yaml, .github/workflows/benchmark.yaml, .github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/release.yaml, .github/workflows/scorecard.yml, .github/workflows/website.yaml — All 8 changed files are under the protected .github/ path. The PR has no linked issue justifying the modification of governance and infrastructure files. Human approval is required for all protected-path changes regardless of context.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (9)

Review

Findings

High

• [protected-path] .github/workflows/ — All 8 changed files are under the protected .github/ path (auto-merge.yaml, benchmark.yaml, checks-codecov.yaml, codeql.yaml, lint.yaml, release.yaml, scorecard.yml, website.yaml). The PR has no linked issue providing justification for modifying governance/infrastructure files. Human approval is required for protected-path changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (10)

Review

Findings

High

• [protected-path] .github/workflows/auto-merge.yaml — This PR modifies 8 files under the protected .github/ path: .github/workflows/auto-merge.yaml, .github/workflows/benchmark.yaml, .github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/release.yaml, .github/workflows/scorecard.yml, .github/workflows/website.yaml. No linked issue provides justification for modifying governance or infrastructure files. Human approval is required for all protected-path changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (11)

Review

Findings

High

• [protected-path] .github/workflows/ — All 8 changed files are under the .github/ protected path prefix. The PR has no linked issue providing authorization for modifying governance and infrastructure files. Human approval is required for protected-path changes. Affected files: .github/workflows/auto-merge.yaml, .github/workflows/benchmark.yaml, .github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/lint.yaml, .github/workflows/release.yaml, .github/workflows/scorecard.yml, .github/workflows/website.yaml.

---

Labels: PR updates GitHub Actions version pins across CI workflow files

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (12)

Review

Findings

High

• [protected-path] .github/workflows/ — This PR modifies 8 files under the governance-protected .github/ path (.github/workflows/auto-merge.yaml, benchmark.yaml, checks-codecov.yaml, codeql.yaml, lint.yaml, release.yaml, scorecard.yml, website.yaml). The PR has no linked issue, so authorization context is insufficient under the protected-path policy even though the description explains the dependency bumps (Renovate changelog for conforma/github-workflows digest, github/codeql-action v4.38.2→v4.39.0, ossf/scorecard-action v2.4.4→v2.5.0, step-security/harden-runner v2.21.1→v2.22.1). GitHub Actions SHA bumps are supply-chain changes and require human review.
  Remediation: Have a maintainer verify each new SHA pin resolves to the claimed version tag and approve the PR manually. The repository's renovate.json governs these updates, but protected-path changes always require human sign-off.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (13)

Review

Findings

Medium

• [protected-path] .github/workflows/ — PR modifies 8 workflow files under the protected .github/ path (auto-merge, benchmark, checks-codecov, codeql, lint, release, scorecard, website). This is a routine Renovate bot PR (author: red-hat-konflux[bot], label: renovate) performing immutable-SHA digest/version bumps for third-party actions: step-security/harden-runner v2.21.1→v2.22.1, ossf/scorecard-action v2.4.4→v2.5.0, conforma/github-workflows digest bump. Repository-level authorization is established via renovate.json. Correctness, security, and style sub-agent passes returned no findings; all pinned SHAs independently verified against upstream release tags. Human approval is always required for protected-path changes, regardless of context.

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (14)

Automated Renovate dependency bump: pinned action SHA/version updates for step-security/harden-runner (v2.21.1 → v2.22.1), ossf/scorecard-action (v2.4.4 → v2.5.0), and conforma/github-workflows digest (837d70f → ff1126b) across eight .github/workflows/ files. No code-level findings surfaced at or above the configured severity threshold. Protected-path (.github/) changes still require human approval regardless of this verdict.

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

Previous run (15)

Review

Findings

High

• [protected-path] .github/workflows/ (8 files) — This PR modifies files under .github/workflows/, a protected path requiring human approval. The PR has no linked issue; authorization is implicit via Renovate automation and the repository's renovate.json (which extends conforma/.github//config/renovate/renovate.json). Affected files: auto-merge.yaml, benchmark.yaml, checks-codecov.yaml, codeql.yaml, lint.yaml, release.yaml, scorecard.yml, website.yaml.
  Remediation: Human reviewer should confirm the digest bumps are intended. Orchestrator-verified: new step-security/harden-runner digest ccd8616d44fd3846e67624a50d5aad6d37bf2d25 resolves to tag v2.22.1; conforma/github-workflows SHA ff1126bc5d04b54ea020efef3c699e53872f2de8 exists on main (identical, ahead_by=0, behind_by=0). SHA-pinning conventions are preserved on all third-party references.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

<!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 -->

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.61% <ø> (ø)
generative	12.22% <ø> (ø)
integration	23.62% <ø> (ø)
unit	72.29% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Superseded by updated review

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Ended 2:13 AM UTC

Commit: 4b6688c · View workflow run →

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Ended 2:43 AM UTC

Commit: 5181ab3 · View workflow run →

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Ended 1:43 AM UTC

Commit: e1d551b · View workflow run →

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Ended 2:00 AM UTC

Commit: e90e784 · View workflow run →

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Ended 3:04 AM UTC

Commit: f8b6bb9 · View workflow run →

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Ended 1:29 AM UTC

Commit: 69bd79e · View workflow run →

[fullsend-ai-review]

🤖 Review · ⚠️ Cancelled · Ended 1:32 AM UTC

Commit: 2b934be · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-retro]

Retro: PR #3627 — Bot dependency update (GitHub Actions)

PR #3627 was a MintMaker/Renovate bot PR updating pinned SHA references for GitHub Actions across 8 workflow files (15 additions, 15 deletions). It was open from Oct 15 to Nov 10, 2026 — 26 days — and was autoclosed without merge.

Timeline

1. Oct 15: red-hat-konflux[bot] opens the PR. Fullsend review agent runs, finds [protected-path] finding (all 8 files under .github/workflows/), submits CHANGES_REQUESTED. Risk assessed as moderate (2/5).
2. Oct 15–Nov 10: MintMaker rebases the PR every 1–3 days. Each rebase triggers a pull_request_target event (review dispatch), followed by a pull_request_review event (fix dispatch). The review always finds the same protected-path issue. The fix eligibility check always rejects (bot author, no fullsend-fix label) but exits with code 1, making the workflow show as "failure."
3. Oct 19: One human review by Acepresso (later DISMISSED when the review agent overwrote it).
4. Nov 10: PR autoclosed. Retro triggered.

By the numbers

• 99 fullsend.yaml workflow runs on this branch (spanning Jun 5–Nov 10, since the branch predates this PR)
• 47 runs during the PR's Oct 15–Nov 10 window: 32 pull_request_target, 15 pull_request_review
• 15 review agent reviews submitted (14 CHANGES_REQUESTED, 1 DISMISSED), all finding the identical [protected-path] issue
• 7 cancelled reviews (superseded by newer commits)
• 14 fix job failures (eligibility check correctly rejects but exits non-zero)
• 0 code changes resulted from any of this activity

Candidates assessed (all summary-only)

Judge scores:

• 3/5 — REVIEW_SKIP_AUTHORS incomplete for MintMaker bot — summary-only (evidence for #3656)
• 2/5 — Fix eligibility exits 1 instead of 0 — summary-only (duplicate of 8 existing issues in fullsend-ai/fullsend)
• 1/5 — Retro agent runs on bot dependency PRs — summary-only (duplicate of fullsend-ai/fullsend #3951, #3833)
• 1/5 — 99 workflow runs wasted on bot branch — summary-only (aggregate evidence, no new actionable proposal)

Evidence for existing issues

conforma/cli #3656 (Configure REVIEW_SKIP_AUTHORS to skip Renovate bot reviews): This PR provides strong additional evidence. Key detail: PR #3627's author is red-hat-konflux[bot] (MintMaker), not renovate[bot]. The proposed fix in #3656 (REVIEW_SKIP_AUTHORS: "renovate[bot]") would not have prevented the waste on this PR. The config should also include red-hat-konflux[bot] to cover MintMaker-authored PRs.

fullsend-ai/fullsend #7092, #7288, #7365, #7701, #7739, #8130, #8382, #8665 (Fix eligibility check exit code): This PR adds another data point — 14 fix job "failures" that are actually correct skip decisions. The check-fix-eligibility script exits 1 when it determines the fix agent should not run, making the overall workflow conclusion "failure" instead of "skipped."

fullsend-ai/fullsend #5360, #7583, #4177, #5067 (Skip bot PR reviews/dispatch at platform level): 99 workflow runs on a single bot dependency branch over 5 months demonstrates the scale of the waste these issues aim to address.

Workflow quality

The review agent's finding was technically correct — .github/workflows/ files are protected paths requiring human approval. However, the same finding was produced 15 times without any mechanism to avoid redundant re-reviews after the first finding was surfaced. The fix agent was dispatched 14 times despite the finding being a policy gate (human approval needed), not a code quality issue fixable by the agent. The existing issue landscape (particularly #3656 in conforma/cli) already proposes the right solution.