Update github-actions (major)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	major	v6 → v7
codecov/codecov-action	action	major	v6 → v7
gitleaks/gitleaks-action	action	major	v2 → v3

---

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in #​2475
• Bump actions/setup-node from 4 to 6 by @​dependabot[bot] in #​2477
• Bump docker/build-push-action from 6.5.0 to 7.2.0 by @​dependabot[bot] in #​2478
• Bump docker/login-action from 3.3.0 to 4.2.0 by @​dependabot[bot] in #​2479
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​2488
• Bump actions/upload-artifact from 4 to 7 by @​dependabot[bot] in #​2476
• eslint 9 by @​dependabot[bot] in #​2474
• Bump the minor-actions-dependencies group with 2 updates by @​dependabot[bot] in #​2499
• skip running unsafe pr check if input is default by @​aiqiaoy in #​2518
• trim only ascii whitespace for branch by @​aiqiaoy in #​2521
• escape values passed to --unset by @​aiqiaoy in #​2530

v7.0.0

Compare Source

• Block checking out fork PR for pull_request_target and workflow_run by @​aiqiaoy in #​2454
• Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @​dependabot[bot] in #​2458
• Bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​2460
• Bump js-yaml from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​2461
• Bump @​actions/core and @​actions/tool-cache and Remove uuid by @​dependabot[bot] in #​2459
• upgrade module to esm and update dependencies by @​aiqiaoy in #​2463
• Bump the minor-npm-dependencies group across 1 directory with 3 updates by @​dependabot[bot] in #​2462

v6.1.0

Compare Source

v6.0.3

Compare Source

• Fix checkout init for SHA-256 repositories by @​yaananth in #​2439
• fix: expand merge commit SHA regex and add SHA-256 test cases by @​yaananth in #​2414

v6.0.2

Compare Source

• Fix tag handling: preserve annotations and explicit fetch-tags by @​ericsciple in #​2356

v6.0.1

Compare Source

• Add worktree support for persist-credentials includeIf by @​ericsciple in #​2327

codecov/codecov-action (codecov/codecov-action)

v7.0.0

Compare Source

⚠️ Due to migration issues with keybase, we are unable to update our keys under the codecovsecurity account. We have deleted the account and are using codecovsecops with the original gpg key

What's Changed

• ci: remove Enforce License Compliance workflow by @​thomasrockhu-codecov in #​1950
• chore(release): 7.0.0 by @​thomasrockhu-codecov in #​1957

Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0

v6.0.2

Compare Source

This is a copy of the v7.0.0 release to make updates easier

What's Changed

• ci: remove Enforce License Compliance workflow by @​thomasrockhu-codecov in #​1950
• chore(release): 7.0.0 by @​thomasrockhu-codecov in #​1957

Full Changelog: codecov/codecov-action@v6.0.1...v6.0.2

v6.0.1

Compare Source

What's Changed

• fix: prevent template injection in run: steps (VULN-1652) by @​thomasrockhu-codecov in #​1947
• chore(release): 6.0.1 by @​thomasrockhu-codecov in #​1949

Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1

gitleaks/gitleaks-action (gitleaks/gitleaks-action)

v3.0.0

Compare Source

What's changed

gitleaks-action v3 migrates the runtime from Node 20 to Node 24. No changes to inputs, outputs, or behavior. Update your workflow from gitleaks/gitleaks-action@v2 to gitleaks/gitleaks-action@v3.

Migration

# Before
- uses: gitleaks/gitleaks-action@v2

# After
- uses: gitleaks/gitleaks-action@v3

Why

GitHub is deprecating the Node 20 runtime for Actions:

• June 2, 2026: GitHub flips the runner default to Node 24. Workflows using gitleaks-action@v2 (Node 20) will still run, but only if ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true is set as an environment variable.
• September 16, 2026: Node 20 is removed from GitHub-hosted runners entirely. gitleaks-action@v2 stops working regardless of any opt-out flag.

Changes

• action.yml: runtime node20 → node24
• @actions/core: 1.10.0 → 1.11.1
• dist/ rebuilt
• Example workflows updated to actions/checkout@v6 and gitleaks-action@v3
• README updated with v3 migration guide

Self-hosted runners

If you use self-hosted runners, ensure your runner version is >= v2.327.1 (required for Node 24 support).

v2.3.9

Compare Source

What's Changed

• bump cache by @​zricethezav in #​181

Full Changelog: gitleaks/gitleaks-action@v2.3.8...v2.3.9

v2.3.8

Compare Source

What's Changed

• Add environment variable to override gitleaks baseRef by @​paulschuberth in #​113
• bump default gitleaks version, update license filename, fix vulns by @​zricethezav in #​178

New Contributors

• @​paulschuberth made their first contribution in #​113

Full Changelog: gitleaks/gitleaks-action@v2.3.7...v2.3.8

v2.3.7

Compare Source

What's Changed

• Update README.md by @​HannesOberreiter in #​165

New Contributors

• @​HannesOberreiter made their first contribution in #​165

Full Changelog: gitleaks/gitleaks-action@v2.3.6...v2.3.7

v2.3.6

Compare Source

What's Changed

• Using DefaultArtifactClient from @​actions/artifact package by @​codykhon in #​157

New Contributors

• @​codykhon made their first contribution in #​157

Full Changelog: gitleaks/gitleaks-action@v2...v2.3.6

v2.3.5

Compare Source

What's Changed

• bumping artifact dep by @​zricethezav in #​153

Full Changelog: gitleaks/gitleaks-action@v2...v2.3.5

v2.3.4

Compare Source

Full Changelog: gitleaks/gitleaks-action@v2.3.3...v2.3.4

v2.3.3

Compare Source

What's Changed

• bump gitleaks version by @​zricethezav in #​111
• Document GITLEAKS_VERSION env var by @​spaze in #​123
• Upgrade from 'node16' to 'node20' by @​ericcornelissen in #​134

New Contributors

• @​spaze made their first contribution in #​123

Full Changelog: gitleaks/gitleaks-action@v2.3.2...v2.3.3

v2.3.2

Compare Source

What's Changed

• Update build instructions by @​ericcornelissen in #​104
• Update build instructions by @​weineran in #​105
• Upload report artifact even if there are no leaks detected by @​weineran in #​106
• Fix undefined repo by @​weineran in #​108

Full Changelog: gitleaks/gitleaks-action@v2.3.1...v2.3.2

v2.3.1

Compare Source

What's Changed

• Upgraded @​actions/core dependency in order to resolve the warning that says "The set-output command is deprecated...". More info: #​100

Full Changelog: gitleaks/gitleaks-action@v2.3.0...v2.3.1

v2.3.0

Compare Source

What's Changed

• Add logo use to EULA by @​zricethezav in #​97
• Switch to plaintext fingerprint by @​weineran in #​98

Full Changelog: gitleaks/gitleaks-action@v2...v2.3.0

v2.2.1

Compare Source

What's Changed

• Log error when comment fails by @​weineran in #​91

Full Changelog: gitleaks/gitleaks-action@v2...v2.2.1

v2.2.0

Compare Source

What's Changed

• Feature/scheduled runs by @​zricethezav in #​89
• populate html_url on scheduled runs by @​zricethezav in #​90

You can now run scheduled runs with gitleaks-action. A scheduled gitleaks-action will scan the entire history of a repo. You can set up a scheduled run by adding schedule to the on entry:

on:
  pull_request:
  push:
  workflow_dispatch:
  schedule:
    - cron: "0 4 * * *" # run once a day at 4 AM

Full Changelog: gitleaks/gitleaks-action@v2...v2.2.0

v2.1.4

Compare Source

What's Changed

• bumping gitleaks by @​zricethezav in #​86

v2.1.3

Compare Source

What's New

• Updates actions/core and gitleaks dependencies #​85

v2.1.2

Compare Source

• Bumps gitleaks dependency to latest version (v8.11.1) #​84

v2.1.1

Compare Source

What's New

• Fixes 0 commit scans on initial PR commit #​82

v2.1.0

Compare Source

What's new

• Bumped Gitleaks version #​80
• Introduced .gitleaksignore comments on PRs #​80

v2.0.8

Compare Source

What's New

• Fixed scanning merge-commits in PRs #​79

v2.0.7

Compare Source

What's Changed:

• Hardcoding gitleaks version by default instead of using latest #​78

v2.0.6

Compare Source

What's New:

• More thorough handling of different exit codes for job Summary #​75
• Changed the comment on PR message #​74

v2.0.5

Compare Source

What's New

• Fix edge case on initial commit to repo when base and head refs are the same.

v2.0.4

Compare Source

What's New

• Ensure there are commits available to scan on push events #​67

v2.0.3

Compare Source

What's New

• Use eventJson.commits for commit range rather than eventJson.before and eventJson.after. This fixes invalid revision range on push event errors.

v2.0.2

Compare Source

What's New

• Fixed action.yml name so this action can be published on the marketplace

v2.0.1

Compare Source

What's New

• Individual user accounts do not need to obtain a license key. 🎉
• Added GITLEAKS_ENABLE_SUMMARY env var option to enable or disable Gitleaks-action job summaries (defaults to true)
• Added GITLEAKS_ENABLE_UPLOAD_ARTIFACT env var option to enable or disable Gitleaks-action job artifact uploads (defaults to true)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!