[dependabot]

Bumps the actions group with 3 updates in the / directory: firebolt-db/integration-testing-setup, reviewdog/action-actionlint and zizmorcore/zizmor-action.

Updates firebolt-db/integration-testing-setup from 1.0.3 to 1.0.4

Release notes

Sourced from firebolt-db/integration-testing-setup's releases.

v1.0.4

What's Changed

• build(deps): bump undici from 5.28.4 to 5.28.5 by @​dependabot[bot] in firebolt-db/integration-testing-setup#45
• Update README with versioning and usage details by @​ptiurin in firebolt-db/integration-testing-setup#47
• ci: use workflow_dispatch Release workflow on releases/v1 by @​fstr in firebolt-db/integration-testing-setup#49
• ci: pin/upgrade actions and harden workflows (v1) by @​fstr in firebolt-db/integration-testing-setup#52
• ci: don't upload zizmor SARIF from fork PRs by @​fstr in firebolt-db/integration-testing-setup#53
• ci: run CodeQL from a workflow on master and releases/** by @​fstr in firebolt-db/integration-testing-setup#58
• ci: run Lint & Scan on every PR so it can be a required check by @​fstr in firebolt-db/integration-testing-setup#56

Full Changelog: firebolt-db/integration-testing-setup@v1.0.3...v1.0.4

Commits

• 1feb289 ci: run Lint & Scan on every PR so it can be a required check (#56)
• 7620a9a ci: run CodeQL from a workflow on master and releases/** (#58)
• af9beb6 ci: don't upload zizmor SARIF from fork PRs (#53)
• 4cd8c3f ci: pin/upgrade actions and harden workflows (v1) (#52)
• 1e68c6c ci: use workflow_dispatch Release workflow on releases/v1 (#49)
• ccaf3a8 Update README with versioning and usage details (#47)
• 5baf710 build(deps): bump undici from 5.28.4 to 5.28.5 (#45)
• See full diff in compare view

Updates reviewdog/action-actionlint from 1.80.0 to 1.80.2

Release notes

Sourced from reviewdog/action-actionlint's releases.

Release v1.80.2

What's Changed

• chore(deps): update python:3.15.0-alpine3.24 docker digest to ff4d3c9 by @​renovate[bot] in reviewdog/action-actionlint#252

Full Changelog: reviewdog/action-actionlint@v1.80.1...v1.80.2

Release v1.80.1

What's Changed

• chore(deps): update python docker tag to v3.15.0 by @​renovate[bot] in reviewdog/action-actionlint#251

Full Changelog: reviewdog/action-actionlint@v1.80.0...v1.80.1

Commits

• 3cbf14e bump v1.80.2
• 7e23c49 Merge branch 'main' into releases/v1
• fd7f9ad Merge pull request #252 from reviewdog/renovate/python-3.15.0-alpine3.24
• 26fdceb chore(deps): update python:3.15.0-alpine3.24 docker digest to ff4d3c9
• 6a9ff88 bump v1.80.1
• 3e1a407 Merge branch 'main' into releases/v1
• 7c5ee49 Merge pull request #251 from reviewdog/renovate/python-3.x
• 5dc7d70 chore(deps): update python docker tag to v3.15.0
• See full diff in compare view

Updates zizmorcore/zizmor-action from 0.6.4 to 0.7.1

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.7.1

zizmor changes

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#178

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#2437)

• The self-hosted-runner audit is now significantly more precise (#2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

• The cache-poisoning audit is now aware of pnpm/setup (#2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

... (truncated)

Commits

• 85b2b9f Sync zizmor versions (#178)
• 38c745a README: bump pins (#177)
• f9597c8 Sync zizmor versions (#175)
• 2181e51 Bump sync-zizmor-versions.py to Python 3.11 for locking (#174)
• 27d989b chore(deps): bump the github-actions group with 2 updates (#173)
• a91218c Bootstrap zizmor without Docker (#169)
• ee3f1bf chore(deps): bump the github-actions group with 2 updates (#170)
• 8eacaa5 README: bump pins (#167)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Note

Medium Risk
v2 integration/nightly jobs now use integration-testing-setup v1.0.4 instead of v2.6.2, which could affect staging DB/engine provisioning if behavior diverged between release lines.

Overview
Bumps pinned third-party GitHub Actions across CI workflows with no changes to job logic or secrets wiring.

Integration / nightly: firebolt-db/integration-testing-setup is pinned to v1.0.4 (1feb289…) in v1 and v2 integration and nightly workflows. v1 moves from v1.0.3; v2 moves from the separate v2.6.2 pin to the same v1.0.4 commit while keeping existing with: inputs (client credentials vs username/password).

Lint & scan: reviewdog/action-actionlint v1.80.0 → v1.80.2 and zizmorcore/zizmor-action v0.6.4 → v0.7.1 in lint-and-scan-actions.yml, updating workflow linting and security scanning tooling.

^{Reviewed by Cursor Bugbot for commit b0b5622. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b0b5622. Configure here.}

[cursor]

v2 workflows pinned to v1 action

High Severity

The v2 workflows now pin firebolt-db/integration-testing-setup to v1.0.4 instead of the previous v2.6.2. Major versions select the product (v1 is Firebolt 1.0, v2 is Firebolt 2.0), so this swap drops client-id auth and will fail v2 integration and nightly setup.

Additional Locations (1)

• .github/workflows/nightly-v2.yml#L58-L59

 

^{Reviewed by Cursor Bugbot for commit b0b5622. Configure here.}

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.