Skip to content

chore: Cherry-picked changes from upstream#240

Merged
Raj-StepSecurity merged 7 commits into
mainfrom
auto-cherry-pick
Jul 23, 2026
Merged

chore: Cherry-picked changes from upstream#240
Raj-StepSecurity merged 7 commits into
mainfrom
auto-cherry-pick

Conversation

@github-actions

@github-actions github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

Cherry-picked changes from upstream.

github-actions Bot added 4 commits July 15, 2026 05:48
@github-actions
ci: enforce ignore-scripts policy for Node package managers
6b571c2
@github-actions
update yarn to 4.15.0
b1a348a 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
@github-actions
fix: use lockfile-aware install commands
5e0ceb4
@github-actions
chore: allow actions-toolkit to bypass yarn age gate
6997c64 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

🚀 PR Updated!

The PR has been updated with the latest cherry-picked commits.

@step-security/maintained-actions-dev Please review and approve the changes.

❌ Build script failed. No files were committed.

📦 Target Release Version: v5.3.0
📋 Previous Release Version: v5.2.0

⚠️ Completely Skipped Commits Due to only modifying files in: package.json, package-lock.json, yarn.lock, node_modules/, dist/, or .gitignore

  • 58abfcafaabb873e5e2972c52bcc1de4b02e6118
  • 0bda481195131bcde0ee38cc081893020c27ff20
  • fad6f4094fcf005d83b753180fff3182a0317bb9
  • b99bfad9ec3205c713be8a9ed2d34f7ba59138e6
  • 041b2bc7bf0080f09a2aa082881465ab1bbdf906
  • 7fd454c341ba9a79f546554f435418d855b2e3a3
  • 30bf55a774cd22e0ef3e5f99cbf23ddf64b838ce
  • b228dba1dba9bed2dd23979dd92249fec7b723eb
  • d740fd856a091fc4bd86adf5fb483b9cf9ecad24
  • 9f0d36ef301d9f1e3fae33115d059730bae61f23
  • cdd694a620fa2883985ba2a63c1beed8b012d6c1
  • 94a1119429ef782ff5f2dd9634afc51c9f7f51a0
  • d4da92b8a7e7b0404d6551860e1f4938321f9526
  • 7f95dd803ae3f42290d2b417255debbd01c4fa3a
  • fd72ef3a31563397396f3919080eac25597bd6c2
  • 9a7f322a49695f8442c8471ad0c73c170c1bcf77
  • 0411cc11d75a944bc2a79ab53ec6c0a222d329c4
  • d080e951a7d1700c9f9c3c1a7e22524b5f5fd459
  • d5f7034d61994b43a8a2fb3770d8d1882bd04e13
  • a5c3af390d70c49b152c18e253aea9dd026cc432
  • 97c520c7cbc45a0311d69c3f83213e4349257a7c
  • 1089dbe3aa050647df9d14a91e8aed1dcbfdced7
  • 8a78e7071e2afed80e6f2ec81c7321345b741876
  • fdb834de3197e336e61f3dfc0b13c9beee74886d
  • d79fe8d95031f5b86bbdfdb57cb8ac7635315887
  • d85e7e7b4dbfc667f6f8085c345122f536d92a61
  • 8ec1dbe7c09e53e920cdbd1646617cd277ac66b8
  • b9f0330e020d5fd8eee67190c241818eca28488e
  • 77ac140b7339d12ae8aadb81cc031af1187efd77
  • 6d7cfa65f60a9dda7b46e5513fa982536f3c9877

🛑 Workflow Files (Cannot be auto-applied by GitHub Actions):

  • .github/workflows/ci.yml from commit cd60ef5ef6d980667b01d828dde042745ffe0f5d
  • .github/workflows/ci.yml from commit f090a805c30692ec0e838f59c4292aacc4e190f1
  • .github/workflows/codeql.yml from commit f090a805c30692ec0e838f59c4292aacc4e190f1
  • .github/workflows/publish.yml from commit f090a805c30692ec0e838f59c4292aacc4e190f1
  • .github/workflows/test.yml from commit f090a805c30692ec0e838f59c4292aacc4e190f1
  • .github/workflows/update-dist.yml from commit f090a805c30692ec0e838f59c4292aacc4e190f1
  • .github/workflows/validate.yml from commit f090a805c30692ec0e838f59c4292aacc4e190f1
  • .github/workflows/test.yml from commit 54f1ae7054937734305b3a5ed6aa201c63463c98
  • .github/workflows/codeql.yml from commit 6fb0473f2cec0fcc189228b836ab58697597aac0
  • .github/workflows/update-dist.yml from commit e4f1214baf8428e76ee70ea912cae8f11c7c836c
  • .github/workflows/pr-assign-author.yml from commit f4d981c6f9750255d151fe39178b182d99388592
  • .github/workflows/zizmor.yml from commit f4d981c6f9750255d151fe39178b182d99388592
  • .github/workflows/ci.yml from commit a544c85209a8326246c4e3bf4f28330062c1ecf2
  • .github/workflows/codeql.yml from commit a544c85209a8326246c4e3bf4f28330062c1ecf2
  • .github/workflows/publish.yml from commit a544c85209a8326246c4e3bf4f28330062c1ecf2
  • .github/workflows/test.yml from commit a544c85209a8326246c4e3bf4f28330062c1ecf2
  • .github/workflows/update-dist.yml from commit a544c85209a8326246c4e3bf4f28330062c1ecf2
  • .github/workflows/validate.yml from commit a544c85209a8326246c4e3bf4f28330062c1ecf2

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

🔍 Cherry-Pick Verification Report

📦 Upstream Changes: v5.2.0...v5.3.0

📋 File-by-File Analysis:

.github/workflows/ci.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - ❌ No PR patch available (+15 -15)

.github/workflows/codeql.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - ❌ No PR patch available (+3 -3)

.github/workflows/pr-assign-author.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - File missing in PR (upstream has 1 additions, 1 deletions)

.github/workflows/publish.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - File missing in PR (upstream has 1 additions, 1 deletions)

.github/workflows/test.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - ❌ No PR patch available (+2 -2)

.github/workflows/update-dist.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - File missing in PR (upstream has 2 additions, 2 deletions)

.github/workflows/validate.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - ❌ No PR patch available (+1 -1)

.github/workflows/zizmor.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - File missing in PR (upstream has 1 additions, 1 deletions)

.yarnrc.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ✅ Yes
  • Changes match: ✅ Yes
  • Status: 🟢 Perfect - ✅ All changes applied correctly (+11 -4)

dev.Dockerfile

  • Upstream has changes: ✅ Yes
  • File exists in PR: ✅ Yes
  • Changes match: ✅ Yes
  • Status: 🟢 Perfect - ✅ All changes applied correctly (+1 -1)

📊 Summary:

  • Total files changed upstream: 10
  • Files present in PR: 2/10
  • Files with matching changes: 2/10

❌ Overall Status: 🔴 INCOMPLETE - Missing files or changes

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

🔍 Cherry-Pick Verification Report

📦 Upstream Changes: v5.2.0...v5.3.0

📋 File-by-File Analysis:

.github/workflows/ci.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - ❌ No PR patch available (+15 -15)

.github/workflows/codeql.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - ❌ No PR patch available (+3 -3)

.github/workflows/pr-assign-author.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - File missing in PR (upstream has 1 additions, 1 deletions)

.github/workflows/publish.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - File missing in PR (upstream has 1 additions, 1 deletions)

.github/workflows/test.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - ❌ No PR patch available (+2 -2)

.github/workflows/update-dist.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - File missing in PR (upstream has 2 additions, 2 deletions)

.github/workflows/validate.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - ❌ No PR patch available (+1 -1)

.github/workflows/zizmor.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - File missing in PR (upstream has 1 additions, 1 deletions)

.yarnrc.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ✅ Yes
  • Changes match: ❌ No
  • Status: 🟡 Partial - ❌ Cherry-pick incomplete (+11 -4) | Missing 4 additions | Missing 4 deletions

dev.Dockerfile

  • Upstream has changes: ✅ Yes
  • File exists in PR: ✅ Yes
  • Changes match: ✅ Yes
  • Status: 🟢 Perfect - ✅ All changes applied correctly (+1 -1)

📊 Summary:

  • Total files changed upstream: 10
  • Files present in PR: 2/10
  • Files with matching changes: 1/10

❌ Overall Status: 🔴 INCOMPLETE - Missing files or changes

@github-actions

github-actions Bot commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

🔍 Cherry-Pick Verification Report

📦 Upstream Changes: v5.2.0...v5.3.0

📋 File-by-File Analysis:

.github/workflows/ci.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - ❌ No PR patch available (+15 -15)

.github/workflows/codeql.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - ❌ No PR patch available (+3 -3)

.github/workflows/pr-assign-author.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - File missing in PR (upstream has 1 additions, 1 deletions)

.github/workflows/publish.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - File missing in PR (upstream has 1 additions, 1 deletions)

.github/workflows/test.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - ❌ No PR patch available (+2 -2)

.github/workflows/update-dist.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - File missing in PR (upstream has 2 additions, 2 deletions)

.github/workflows/validate.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - ❌ No PR patch available (+1 -1)

.github/workflows/zizmor.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - File missing in PR (upstream has 1 additions, 1 deletions)

.yarnrc.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ✅ Yes
  • Changes match: ✅ Yes
  • Status: 🟢 Perfect - ✅ All changes applied correctly (+11 -4)

dev.Dockerfile

  • Upstream has changes: ✅ Yes
  • File exists in PR: ✅ Yes
  • Changes match: ✅ Yes
  • Status: 🟢 Perfect - ✅ All changes applied correctly (+1 -1)

📊 Summary:

  • Total files changed upstream: 10
  • Files present in PR: 2/10
  • Files with matching changes: 2/10

❌ Overall Status: 🔴 INCOMPLETE - Missing files or changes

anurag-stepsecurity
anurag-stepsecurity reviewed Jul 15, 2026
View reviewed changes
Comment thread .yarnrc.yml Outdated
enableGlobalCache: false
enableHardenedMode: true
enableScripts: false
npmMinimalAgeGate: 2d

@anurag-stepsecurity anurag-stepsecurity Jul 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's keep it to 3d otherwise our required check would fail.

Suggested change
npmMinimalAgeGate: 2d
npmMinimalAgeGate: 3d

@github-actions

github-actions Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor Author

🔍 Cherry-Pick Verification Report

📦 Upstream Changes: v5.2.0...v5.3.0

📋 File-by-File Analysis:

.github/workflows/ci.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - ❌ No PR patch available (+15 -15)

.github/workflows/codeql.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - ❌ No PR patch available (+3 -3)

.github/workflows/pr-assign-author.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - File missing in PR (upstream has 1 additions, 1 deletions)

.github/workflows/publish.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - File missing in PR (upstream has 1 additions, 1 deletions)

.github/workflows/test.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - ❌ No PR patch available (+2 -2)

.github/workflows/update-dist.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - File missing in PR (upstream has 2 additions, 2 deletions)

.github/workflows/validate.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - ❌ No PR patch available (+1 -1)

.github/workflows/zizmor.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ❌ No
  • Status: 🔴 Missing - File missing in PR (upstream has 1 additions, 1 deletions)

.yarnrc.yml

  • Upstream has changes: ✅ Yes
  • File exists in PR: ✅ Yes
  • Changes match: ❌ No
  • Status: 🟡 Partial - ❌ Cherry-pick incomplete (+11 -4) | Missing 1 additions

dev.Dockerfile

  • Upstream has changes: ✅ Yes
  • File exists in PR: ✅ Yes
  • Changes match: ✅ Yes
  • Status: 🟢 Perfect - ✅ All changes applied correctly (+1 -1)

📊 Summary:

  • Total files changed upstream: 10
  • Files present in PR: 2/10
  • Files with matching changes: 1/10

❌ Overall Status: 🔴 INCOMPLETE - Missing files or changes

@Raj-StepSecurity
Raj-StepSecurity merged commit 38145fa into main Jul 23, 2026
70 of 72 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@anurag-stepsecurity anurag-stepsecurity anurag-stepsecurity approved these changes

Assignees

No one assigned

Labels

review-required

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@anurag-stepsecurity @Raj-StepSecurity