Skip to content

chore(deps): update github workflows #6733

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: master
Choose a base branch
from
Open

chore(deps): update github workflows #6733

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/ai-integration-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,17 +19,17 @@ jobs:

steps:
- name: Setup Python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7

@cursor cursor Bot Jul 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Invalid setup-python action pin

High Severity

actions/setup-python is pinned to 5fda3b95... with comment # v7, but the PR’s own update table targets digest ece7cb0 (published v6.3.0), and there is no published setup-python v7 release matching that SHA. The AI integration workflow can fail at action resolution before tests run.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit ae76386. Configure here.

with:
python-version: 3.14t

- name: Setup Node.js
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
Comment thread
sentry-warden[bot] marked this conversation as resolved.
node-version: '20'
node-version: '24'

- name: Checkout repo
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
token: ${{ secrets.GITHUB_TOKEN }}

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/changelog-preview.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,6 @@ permissions:

jobs:
changelog-preview:
uses: getsentry/craft/.github/workflows/changelog-preview.yml@6143e76379c342e247687c4ab5c83d8b900cc273 # v2
uses: getsentry/craft/.github/workflows/changelog-preview.yml@667b5f5669552a35990a11ff6ac1131febb07446 # v2
secrets:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
12 changes: 6 additions & 6 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,9 @@ jobs:
timeout-minutes: 10

steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
python-version: 3.14

Expand All @@ -46,9 +46,9 @@ jobs:
timeout-minutes: 10

steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
python-version: 3.14
- name: Build Packages
Expand All @@ -71,9 +71,9 @@ jobs:
timeout-minutes: 10

steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
python-version: 3.14

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/enforce-license-compliance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,6 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: 'Enforce License Compliance'
uses: getsentry/action-enforce-license-compliance@48236a773346cb6552a7bda1ee370d2797365d87 # main
uses: getsentry/action-enforce-license-compliance@d0aa91b82375e45135e96c02f17ce3b8002867cd # main
with:
fossa_api_key: ${{ secrets.FOSSA_API_KEY }}
4 changes: 2 additions & 2 deletions .github/workflows/flaky-test-detector.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ jobs:
environment: AI Integrations Tests

Comment thread
sentry-warden[bot] marked this conversation as resolved.
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

# --- Step A: deterministic collection of UNTRUSTED CI logs -----------
# Runs with the read-only GITHUB_TOKEN. No LLM here. Writes failure logs
Expand Down Expand Up @@ -108,7 +108,7 @@ jobs:
# and the repo, and writes the issue body to flaky-issue-body.md.
- name: Analyze logs and summarize flaky tests
if: steps.collect.outputs.collected != '0'
uses: anthropics/claude-code-action@11ba60486e4aec9ddfeafcf4bb3f00b028ac2c16 # v1.0.142
uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1.0.183
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
github_token: ${{ github.token }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,12 +26,12 @@ jobs:
with:
app-id: ${{ vars.SENTRY_RELEASE_BOT_CLIENT_ID }}
private-key: ${{ secrets.SENTRY_RELEASE_BOT_PRIVATE_KEY }}
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
token: ${{ steps.token.outputs.token }}
fetch-depth: 0
- name: Prepare release
uses: getsentry/craft@6143e76379c342e247687c4ab5c83d8b900cc273 # v2.26.9
uses: getsentry/craft@667b5f5669552a35990a11ff6ac1131febb07446 # 2.27.0
env:
GITHUB_TOKEN: ${{ steps.token.outputs.token }}
with:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-agents.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-ai-workflow.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

Check failure on line 27 in .github/workflows/test-integrations-ai-workflow.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

[LLR-P48] actions/checkout pinned to non-existent v7.0.1 (additional location) 

The workflow pins `actions/checkout` to SHA `3d3c42e5...` with comment `# v7.0.1`, but `actions/checkout` has no v7 release. The fabricated version comment prevents verifying the SHA belongs to the official repository, exposing CI to a potential supply chain attack.
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-ai.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-cloud.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
Comment thread
sentry-warden[bot] marked this conversation as resolved.
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-common.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test-integrations-dbs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
os: [ubuntu-22.04]
services:
postgres:
image: ghcr.io/getsentry/image-mirror-library-postgres:17-alpine
image: ghcr.io/getsentry/image-mirror-library-postgres:18-alpine
Comment thread
sentry-warden[bot] marked this conversation as resolved.
env:
POSTGRES_PASSWORD: sentry
# Set health checks to wait until postgres has started
Expand Down Expand Up @@ -54,9 +54,9 @@
SENTRY_PYTHON_TEST_MYSQL_PASSWORD: sentry
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

Check failure on line 57 in .github/workflows/test-integrations-dbs.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

actions/checkout pinned to non-existent v7.0.1 

The workflow pins `actions/checkout` to SHA `3d3c42e5...` with comment `# v7.0.1`, but `actions/checkout` has no v7 release. The fabricated version comment prevents verifying the SHA belongs to the official repository, exposing CI to a potential supply chain attack.

@sentry-warden sentry-warden Bot Jul 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actions/checkout pinned to non-existent v7.0.1

The workflow pins actions/checkout to SHA 3d3c42e5... with comment # v7.0.1, but actions/checkout has no v7 release. The fabricated version comment prevents verifying the SHA belongs to the official repository, exposing CI to a potential supply chain attack.

Evidence
  • Hunk line 57 changes the pin to actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1.
  • The official actions/checkout repository latest major release is v4.x; a v7.0.1 tag has never existed.
  • The same impossible version comment appears in ci.yml, release.yml, test.yml, and every generated test workflow.
  • Because the comment is fake, reviewers cannot map the SHA to a trustworthy release, defeating the security purpose of commit-pinning and enabling a compromised or backdoored action to go undetected.
Also found at 1 additional location
  • .github/workflows/test-integrations-ai-workflow.yml:27-27

Identified by Warden · find-bugs · LLR-P48

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: "Setup ClickHouse Server"
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-flags.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
Comment thread
sentry-warden[bot] marked this conversation as resolved.
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-gevent.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-graphql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-mcp.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-misc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-network.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test-integrations-tasks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,13 +35,13 @@ jobs:
SENTRY_PYTHON_TEST_REDIS_HOST: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'redis' || 'localhost' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Install Java
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
with:
distribution: 'temurin'
java-version: '21'
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test-integrations-web-1.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@
os: [ubuntu-22.04]
services:
postgres:
image: ghcr.io/getsentry/image-mirror-library-postgres:17-alpine
image: ghcr.io/getsentry/image-mirror-library-postgres:18-alpine

Check failure on line 24 in .github/workflows/test-integrations-web-1.yml

View check run for this annotation

@sentry/warden / warden: code-review

PostgreSQL 18 image does not exist, CI service containers will fail to start 

PostgreSQL 18 has not been released yet; the `ghcr.io/getsentry/image-mirror-library-postgres:18-alpine` image will fail to pull and break workflows that depend on the Postgres service.

@sentry-warden sentry-warden Bot Jul 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PostgreSQL 18 image does not exist, CI service containers will fail to start

PostgreSQL 18 has not been released yet; the ghcr.io/getsentry/image-mirror-library-postgres:18-alpine image will fail to pull and break workflows that depend on the Postgres service.

Evidence
  • PostgreSQL 17 was released in September 2024 and is the current latest stable major version.
  • PostgreSQL 18 is scheduled for release in September 2025 and no official 18-alpine image exists yet.
  • The image-mirror-library-postgres:18-alpine tag change from 17-alpine came from an automated version bump treating the major version as semver.
  • When GitHub Actions tries to start the service container, it will fail with a manifest-unknown / image-not-found error.

Identified by Warden · code-review · X5H-Y3W

env:
POSTGRES_PASSWORD: sentry
# Set health checks to wait until postgres has started
Expand All @@ -41,9 +41,9 @@
SENTRY_PYTHON_TEST_POSTGRES_PASSWORD: sentry
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-integrations-web-2.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ jobs:
TOX_UV_PYTHON_PREFERENCE: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && 'only-system' || 'managed' }}
container: ${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false
- name: Mark workspace safe for git (3.6/3.7 container)
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,9 +98,9 @@
if: ${{ !cancelled() }}
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
- name: Download coverage data
# Artifacts from the reusable test workflows live in this same run.
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
Expand All @@ -115,7 +115,7 @@
uv run coverage combine .coverage-sentry-*
uv run coverage xml
- name: Report coverage and test results
uses: getsentry/codecov-action@d90e69cdf071dfbb0430159125321dc09c424d4c # main
uses: getsentry/codecov-action@66554aa51d8656c657e233a9e98bcb18e95f2c9a # main

Check warning on line 118 in .github/workflows/test.yml

View check run for this annotation

@sentry/warden / warden: find-bugs

codecov-action template and generated file out of sync 

The generated `.github/workflows/test.yml` was updated but its Jinja template `scripts/split_tox_gh_actions/templates/test_orchestrator.jinja` was not, so regenerating workflows will revert the action to an older SHA.
Comment thread
sentry-warden[bot] marked this conversation as resolved.
with:
token: ${{ secrets.GITHUB_TOKEN }}
files: coverage.xml
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/update-tox.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,12 @@ jobs:

steps:
- name: Checkout repo
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
token: ${{ secrets.GITHUB_TOKEN }}

- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
cache-python: true

Comment thread
sentry-warden[bot] marked this conversation as resolved.
Expand Down
8 changes: 4 additions & 4 deletions scripts/split_tox_gh_actions/templates/test_group.jinja
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
{% endif %}
{% if needs_postgres %}
postgres:
image: ghcr.io/getsentry/image-mirror-library-postgres:17-alpine
image: ghcr.io/getsentry/image-mirror-library-postgres:18-alpine
env:
POSTGRES_PASSWORD: sentry
Comment thread
sentry-warden[bot] marked this conversation as resolved.
# Set health checks to wait until postgres has started
Expand Down Expand Up @@ -72,9 +72,9 @@
{% endif %}
container: {% raw %}${{ (matrix.python-version == '3.6' || matrix.python-version == '3.7') && format('python:{0}', matrix.python-version) || null }}{% endraw %}
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install uv
uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
enable-cache: false

Expand All @@ -85,7 +85,7 @@

{% if needs_java %}
- name: Install Java
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
with:
distribution: 'temurin'
java-version: '21'
Expand Down
Loading
Loading