Update github actions (main) (patch)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
codecov/codecov-action	action	patch	v5.5.4 → v5.5.5
github/codeql-action	action	patch	v4.37.3 → v4.37.4
ossf/scorecard-action	action	patch	v2.4.3 → v2.4.4
peter-evans/create-pull-request	action	patch	v8.1.0 → v8.1.1

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

codecov/codecov-action (codecov/codecov-action)

v5.5.5

Compare Source

This release only contains the keybase.io change as described here.

Full Changelog: codecov/codecov-action@v5.5.4...v5.5.5

github/codeql-action (github/codeql-action)

v4.37.4

Compare Source

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #​4037
• Update default CodeQL bundle version to 2.26.2. #​4051

ossf/scorecard-action (ossf/scorecard-action)

v2.4.4

Compare Source

What's Changed

This update bumps the Scorecard version to the v5.5.0 release. For a complete list of changes, please refer to the Scorecard v5.4.0 release notes and the Scorecard v5.5.0 release notes.

• log POST failures instead of failing entire action by @​spencerschrock in #​1625

Full Changelog: ossf/scorecard-action@v2.4.3...v2.4.4

peter-evans/create-pull-request (peter-evans/create-pull-request)

v8.1.1: Create Pull Request v8.1.1

Compare Source

What's Changed

• build(deps-dev): bump the npm group with 2 updates by @​dependabot[bot] in #​4305
• build(deps): bump minimatch by @​dependabot[bot] in #​4311
• build(deps): bump the github-actions group with 2 updates by @​dependabot[bot] in #​4316
• build(deps): bump @​tootallnate/once and jest-environment-jsdom by @​dependabot[bot] in #​4323
• build(deps-dev): bump undici from 6.23.0 to 6.24.0 by @​dependabot[bot] in #​4328
• build(deps-dev): bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in #​4334
• build(deps): bump picomatch by @​dependabot[bot] in #​4339
• build(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by @​dependabot[bot] in #​4344
• build(deps-dev): bump the npm group with 3 updates by @​dependabot[bot] in #​4349
• fix: retry post-creation API calls on 422 eventual consistency errors by @​peter-evans in #​4356

Full Changelog: peter-evans/create-pull-request@v8.1.0...v8.1.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:25 AM UTC · Completed 2:34 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

Review

Findings

High

• [protected-path] .github/workflows/ — PR modifies 4 files under the .github/ protected path (.github/workflows/checks-codecov.yaml, .github/workflows/codeql.yaml, .github/workflows/scorecard.yml, .github/workflows/update-go-containerregistry.yaml). No linked issue provides authorization for modifying governance/infrastructure files. Human approval is required for all protected-path changes.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [protected-path] .github/workflows/ — This PR modifies 3 files under the protected .github/ path: checks-codecov.yaml, scorecard.yml, update-go-containerregistry.yaml. No linked issue provides authorization for changes to governance/infrastructure files. The changes are routine patch-level version bumps for GitHub Actions (codecov/codecov-action v5.5.4→v5.5.5, ossf/scorecard-action v2.4.3→v2.4.4, peter-evans/create-pull-request v8.1.0→v8.1.1) with updated commit SHA pins. No permissions, secrets scoping, or workflow triggers were modified. Human approval is required for protected-path changes.
  Remediation: Obtain human review and approval for changes to protected paths.

---

Labels: PR updates GitHub Actions workflow files with version pin bumps

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.41% <ø> (ø)
generative	16.36% <ø> (ø)
integration	27.58% <ø> (ø)
unit	71.97% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 2:19 AM UTC · Completed 2:28 AM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 12:24 PM UTC · Completed 12:36 PM UTC
Commit: 87c4a29 · View workflow run →

[fullsend-ai-retro]

Retro: PR #3448 — Update GitHub Actions (MintMaker patch bump)

Timeline

1. Aug 1, 02:24 UTC — MintMaker bot (red-hat-konflux[bot]) opened the PR to bump 4 GitHub Actions (codecov/codecov-action, github/codeql-action, ossf/scorecard-action, peter-evans/create-pull-request) to patch versions. Automerge enabled. 10 additions, 10 deletions across 4 .github/workflows/ files.
2. Aug 1, 02:25–02:34 UTC — Review agent run 30679957000 (~9 min, Opus model). Found one High finding: [protected-path] — PR modifies .github/workflows/ files requiring human approval. Submitted CHANGES_REQUESTED. First run included detailed analysis confirming changes are routine patch-level version bumps with no permissions, triggers, or secrets modifications.
3. Aug 3, 02:18 UTC — Bot force-pushed a rebase (added codeql.yaml update).
4. Aug 3, 02:19–02:28 UTC — Second review agent run 30778980310 (~9 min, Opus). Same [protected-path] finding for 4 files (was 3). CHANGES_REQUESTED again.
5. Aug 3, 12:23 UTC — Human reviewer dheerajodha approved. PR merged via automerge.
6. Aug 3, 12:24 UTC — Retro agent dispatched.

Assessment

The workflow functioned correctly. The review agent properly identified the protected-path governance requirement, CHANGES_REQUESTED blocked automerge until human review, and the human provided the required approval. Review quality was appropriate — the agent correctly scoped its finding to the governance concern without false positives on the code content.

The main concern is efficiency. Two full Opus-tier review runs (~18 minutes total wall-clock) for a 10-line bot-authored version pin update is disproportionate. The second run after rebase produced an identical finding.

Existing issue coverage

All improvement areas identified are well-covered by existing open issues. No new proposals filed. Key evidence from this PR:

• Opus for trivial dependency bumps — This PR adds evidence for fullsend-ai/agents#513 (short-circuit to lightweight mode for mechanical dependency bumps) and fullsend-ai/agents#497 (downgrade models based on scope classification). Both review runs used ~9 minutes of Opus time for a change the agent itself characterized as "routine patch-level version bumps."
• Redundant re-review on rebase — Evidence for fullsend-ai/agents#108 (short-circuit on rebase-only pushes) and fullsend-ai/fullsend#4596 / #4652 (Renovate-specific rebase re-review avoidance). The rebase added one file following the identical pattern; the finding was unchanged.
• Protected-path friction for trusted bot bumps — Evidence for fullsend-ai/fullsend#4387 (conditional protected-path exceptions for trusted bot version-only bumps). The agent confirmed no permissions, secrets, or triggers changed, yet the policy still required human sign-off.
• Retro on bot PR — Evidence for fullsend-ai/agents#349 (skip retro on PRs with zero fullsend code/triage involvement) and conforma/cli#3420 (repo-level dispatch skip for MintMaker branches). This retro run itself is an example of the waste — no code or triage agent was involved, only the review agent enforcing a governance gate.