Bump actions/setup-go from 6.4.0 to 7.0.0 by dependabot[bot] · Pull Request #974 · konflux-ci/multi-platform-controller

dependabot · 2026-07-20T07:43:55Z

Bumps actions/setup-go from 6.4.0 to 7.0.0.

Release notes

Sourced from actions/setup-go's releases.

v7.0.0

What's Changed

Migrate to ESM and upgrade dependencies by @priyagupta108 in actions/setup-go#763

chore(deps): bump @actions/cache to 6.2.0 by @philip-gai in actions/setup-go#771

New Contributors

@philip-gai made their first contribution in actions/setup-go#771

Full Changelog: actions/setup-go@v6...v7.0.0

v6.5.0

What's Changed

Dependency update

Upgrade actions dependencies by @priyagupta108 with @Copilot in actions/setup-go#744

Upgrade @types/node and typescript-eslint dependencies to resolve npm audit findings by @HarithaVattikuti in actions/setup-go#755

Upgrade @actions/cache to 5.1.0, log cache write denied by @jasongin in actions/setup-go#758

Upgrade version to 6.5.0 in package.json and package-lock.json by @HarithaVattikuti in actions/setup-go#762

New Contributors

@priyagupta108 with @Copilot made their first contribution in actions/setup-go#744

@jasongin made their first contribution in actions/setup-go#758

Full Changelog: actions/setup-go@v6...v6.5.0

Commits

b7ad1da chore(deps): bump @actions/cache to 6.2.0 (#771)
0778a10 Migrate to ESM and upgrade dependencies (#763)
924ae3a chore: bump version to 6.5.0 in package.json and package-lock.json (#762)
e91cc3b Bump @actions/cache to 5.1.0, log cache write denied (#758)
4a2405e chore: update @types/node and @typescript-eslint dependencies to latest versi...
78961f6 chore: update @actions dependencies and refresh license cache (#744)
See full diff in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

fullsend-ai-review · 2026-07-20T07:44:44Z

🤖 Finished Review · ✅ Success · Started 7:44 AM UTC · Completed 7:48 AM UTC
Commit: 37b10e4 · View workflow run →

fullsend-ai-review · 2026-07-20T07:48:12Z

Review

Findings

Medium

[supply-chain / dependency pinning] .github/workflows/go-ci.yaml:19 — The PR bumps actions/setup-go from 6.4.0 to 7.0.0 (a major version bump), but the inline version comment still reads # v6 in all four occurrences across three workflow files (go-ci.yaml lines 19 and 44, mpc-test.yaml line 36, test-e2e.yml line 67). This stale comment obscures the actual version during future audits, undermining the purpose of SHA-pinning comments.
Remediation: Update the inline comment from # v6 to # v7 (or # v7.0.0) in all four occurrences.

Labels: Major version bump from actions/setup-go v6 to v7 warrants semver/major label.

Previous run

Review — ✅ Approve

PR: #974 — Bump actions/setup-go from 6.4.0 to 7.0.0
Author: dependabot[bot]

Summary

Straightforward Dependabot dependency bump updating the actions/setup-go SHA pin from 4a3601121dd01d1626a1e23e37211e3254c1c06c (v6.4.0) to b7ad1dad31e06c5925ef5d2fc7ad053ef454303e (v7.0.0) across all three CI workflow files (4 locations total).

Verified

✅ SHA integrity — the new SHA b7ad1dad31e06c5925ef5d2fc7ad053ef454303e matches the v7.0.0 release per the actions/setup-go releases
✅ Completeness — all 4 usages of actions/setup-go across .github/workflows/go-ci.yaml (2), .github/workflows/mpc-test.yaml (1), and .github/workflows/test-e2e.yml (1) are updated consistently
✅ Interface compatibility — the go-version-file input used in all workflows is supported in v7.0.0; release notes indicate internal changes only (ESM migration, dependency upgrades)
✅ No injection risk — PR body contains standard Dependabot content with no instruction-like patterns

Findings

Severity	File	Finding
low	`.github/workflows/go-ci.yaml`	Version comment says `# v6` but should be `# v7` after major version bump (also in `mpc-test.yaml` and `test-e2e.yml`)

Details

[style/version-comment] — Stale version comment in SHA pins (low)

All four updated lines retain the comment # v6:

uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v6

Since this is a major version bump to v7.0.0, the comment should read # v7 for accuracy. The SHA pin is the actual version control mechanism, so this is cosmetic, but a stale comment can mislead future maintainers into thinking the action is still on the v6 major line.

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

.github/workflows/go-ci.yaml

.github/workflows/mpc-test.yaml

.github/workflows/test-e2e.yml

codecov-commenter · 2026-07-20T07:55:29Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 30.38%. Comparing base (4dd43e1) to head (0b53e7b).

❗ There is a different number of reports uploaded between BASE (4dd43e1) and HEAD (0b53e7b). Click for more details.

HEAD has 3 uploads less than BASE

Flag BASE (4dd43e1) HEAD (0b53e7b)

e2e-tests 2 1

unit-tests 2 0

Additional details and impacted files

@@             Coverage Diff             @@
##             main     #974       +/-   ##
===========================================
- Coverage   76.92%   30.38%   -46.54%     
===========================================
  Files          26       26               
  Lines        2817     2817               
===========================================
- Hits         2167      856     -1311     
- Misses        452     1797     +1345     
+ Partials      198      164       -34

Flag	Coverage Δ
e2e-tests	`30.38% <ø> (-0.11%)`	⬇️
unit-tests	`?`

Flags with carried forward coverage won't be shown. Click here to find out more.
see 22 files with indirect coverage changes

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4dd43e1...0b53e7b. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.4.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@4a36011...b7ad1da) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

fullsend-ai-review · 2026-07-23T22:14:41Z

🤖 Finished Review · ✅ Success · Started 10:14 PM UTC · Completed 10:24 PM UTC
Commit: 37b10e4 · View workflow run →

fullsend-ai-review

See the review comment for full details.

fullsend-ai-review · 2026-07-23T22:24:30Z

        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
      - name: Install Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v6


[medium] supply-chain / dependency pinning

The PR bumps actions/setup-go from 6.4.0 to 7.0.0 (a major version bump), but the inline version comment still reads # v6 in all four occurrences across three workflow files (go-ci.yaml lines 19 and 44, mpc-test.yaml line 36, test-e2e.yml line 67). This stale comment obscures the actual version during future audits, undermining the purpose of SHA-pinning comments.

Suggested fix: Update the inline comment from # v6 to # v7 (or # v7.0.0) in all four occurrences.

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 20, 2026

dependabot Bot mentioned this pull request Jul 20, 2026

Bump actions/setup-go from 6.4.0 to 6.5.0 #953

Closed

This comment was marked as outdated.

Sign in to view

fullsend-ai-review Bot added the requires-manual-review Review requires human judgment label Jul 20, 2026

dependabot Bot force-pushed the dependabot/github_actions/actions/setup-go-7.0.0 branch from df32216 to 0b53e7b Compare July 23, 2026 22:13

fullsend-ai-review Bot reviewed Jul 23, 2026

View reviewed changes

fullsend-ai-review Bot added the semver/major Semver major version bump label Jul 23, 2026

Navigation Menu

Uh oh!

Bump actions/setup-go from 6.4.0 to 7.0.0 - #974

Bump actions/setup-go from 6.4.0 to 7.0.0#974
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/actions/setup-go-7.0.0

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited

Loading

Uh oh!

fullsend-ai-review Bot commented Jul 20, 2026 •

edited

Loading

Uh oh!

fullsend-ai-review Bot commented Jul 20, 2026 •

edited

Loading

Review — ✅ Approve

Summary

Verified

Findings

Details

Uh oh!

This comment was marked as outdated.

Uh oh!

codecov-commenter commented Jul 20, 2026 •

edited

Loading

Uh oh!

fullsend-ai-review Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

fullsend-ai-review Bot left a comment

Uh oh!

fullsend-ai-review Bot Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v7.0.0

What's Changed

New Contributors

v6.5.0

What's Changed

Dependency update

New Contributors

Uh oh!

fullsend-ai-review Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review

Findings

Medium

Review — ✅ Approve

Summary

Verified

Findings

Details

Uh oh!

This comment was marked as outdated.

Uh oh!

codecov-commenter commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

fullsend-ai-review Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

fullsend-ai-review Bot Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jul 20, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jul 20, 2026 •

edited

Loading

codecov-commenter commented Jul 20, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jul 23, 2026 •

edited

Loading