[dependabot]

Bumps the actions group with 4 updates in the / directory: firebolt-db/integration-testing-setup, reviewdog/action-actionlint, zizmorcore/zizmor-action and firebolt-db/action-slack-nightly-notify.

Updates firebolt-db/integration-testing-setup from 1.0.3 to 1.0.4

Release notes

Sourced from firebolt-db/integration-testing-setup's releases.

v1.0.4

What's Changed

• build(deps): bump undici from 5.28.4 to 5.28.5 by @​dependabot[bot] in firebolt-db/integration-testing-setup#45
• Update README with versioning and usage details by @​ptiurin in firebolt-db/integration-testing-setup#47
• ci: use workflow_dispatch Release workflow on releases/v1 by @​fstr in firebolt-db/integration-testing-setup#49
• ci: pin/upgrade actions and harden workflows (v1) by @​fstr in firebolt-db/integration-testing-setup#52
• ci: don't upload zizmor SARIF from fork PRs by @​fstr in firebolt-db/integration-testing-setup#53
• ci: run CodeQL from a workflow on master and releases/** by @​fstr in firebolt-db/integration-testing-setup#58
• ci: run Lint & Scan on every PR so it can be a required check by @​fstr in firebolt-db/integration-testing-setup#56

Full Changelog: firebolt-db/integration-testing-setup@v1.0.3...v1.0.4

Commits

• 1feb289 ci: run Lint & Scan on every PR so it can be a required check (#56)
• 7620a9a ci: run CodeQL from a workflow on master and releases/** (#58)
• af9beb6 ci: don't upload zizmor SARIF from fork PRs (#53)
• 4cd8c3f ci: pin/upgrade actions and harden workflows (v1) (#52)
• 1e68c6c ci: use workflow_dispatch Release workflow on releases/v1 (#49)
• ccaf3a8 Update README with versioning and usage details (#47)
• 5baf710 build(deps): bump undici from 5.28.4 to 5.28.5 (#45)
• See full diff in compare view

Updates reviewdog/action-actionlint from 1.80.0 to 1.80.2

Release notes

Sourced from reviewdog/action-actionlint's releases.

Release v1.80.2

What's Changed

• chore(deps): update python:3.15.0-alpine3.24 docker digest to ff4d3c9 by @​renovate[bot] in reviewdog/action-actionlint#252

Full Changelog: reviewdog/action-actionlint@v1.80.1...v1.80.2

Release v1.80.1

What's Changed

• chore(deps): update python docker tag to v3.15.0 by @​renovate[bot] in reviewdog/action-actionlint#251

Full Changelog: reviewdog/action-actionlint@v1.80.0...v1.80.1

Commits

• 3cbf14e bump v1.80.2
• 7e23c49 Merge branch 'main' into releases/v1
• fd7f9ad Merge pull request #252 from reviewdog/renovate/python-3.15.0-alpine3.24
• 26fdceb chore(deps): update python:3.15.0-alpine3.24 docker digest to ff4d3c9
• 6a9ff88 bump v1.80.1
• 3e1a407 Merge branch 'main' into releases/v1
• 7c5ee49 Merge pull request #251 from reviewdog/renovate/python-3.x
• 5dc7d70 chore(deps): update python docker tag to v3.15.0
• See full diff in compare view

Updates zizmorcore/zizmor-action from 0.6.4 to 0.7.1

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.7.1

zizmor changes

Bug Fixes 🐛🔗

• Fixed a regression in 1.31.0 where some ignore comments/configurations would no longer apply to the dangerous-triggers audit

action changes

The default version of zizmor is now 1.31.1.

What's Changed

• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#178

Full Changelog: zizmorcore/zizmor-action@v0.7.0...v0.7.1

v0.7.0

Sponsorship is appreciated!

zizmor notes

Enhancements 🌱🔗

• The typosquat-uses audit now supports pre-commit config inputs (#2437)

• The self-hosted-runner audit is now significantly more precise (#2350)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The dangerous-triggers audit now considers the issue_comment trigger fundamentally dangerous (#2396)

• zizmor is now aware of the image_version workflow trigger (#2397)

• The dangerous-triggers audit now produces more precise finding/diagnostic spans (#2402)

• The cache-poisoning audit is now aware of pnpm/setup (#2409)

• The unpinned-images audit now produces more precise findings when the user's workflow contains an indirect matrix (#2395)

  Many thanks to @​ubiratansoares for proposing and implementing this enhancement!

• The cache-poisoning audit is now aware of GitHub's new cache-mode: setting, and will skip any findings that would occur when a job has an effective cache-mode: none (#2418)

• The cache-poisoning audit now flags usages of cache-mode: write and cache-mode: write-only with dangerous triggers, i.e. triggers that give an attacker privileged code execution (#2426)

• zizmor now uses a tree-sitter grammar for PowerShell that's more precise/capable of capturing more non-trivial PowerShell expressions (#2444)

Bug Fixes 🐛🔗

... (truncated)

Commits

• 85b2b9f Sync zizmor versions (#178)
• 38c745a README: bump pins (#177)
• f9597c8 Sync zizmor versions (#175)
• 2181e51 Bump sync-zizmor-versions.py to Python 3.11 for locking (#174)
• 27d989b chore(deps): bump the github-actions group with 2 updates (#173)
• a91218c Bootstrap zizmor without Docker (#169)
• ee3f1bf chore(deps): bump the github-actions group with 2 updates (#170)
• 8eacaa5 README: bump pins (#167)
• See full diff in compare view

Updates firebolt-db/action-slack-nightly-notify from 1.0.0 to 1.0.1

Release notes

Sourced from firebolt-db/action-slack-nightly-notify's releases.

v1.0.1

• slackapi/slack-github-action pinned to v1.27.1 (commit SHA).
• Release workflow with minimal permissions; lint & scan workflow (actionlint, zizmor) and the standard PR title check.
• README improvements.

Commits

• 38a20fc ci: standardize the PR title check (FB-4904) (#2)
• 9ddce5d ci: pin actions, restrict permissions, add lint & scan workflow (FB-4904) (#1)
• 903898e docs: Improving readme
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

---

Note

Medium Risk
v2 integration/nightly jobs switch from integration-testing-setup v2.6.2 to v1.0.4, which could affect staging DB/engine provisioning if inputs or behavior differ; otherwise routine CI dependency pins.

Overview
Bumps pinned GitHub Actions across CI workflows with no application code changes.

firebolt-db/integration-testing-setup is updated to commit 1feb289 (v1.0.4) in integration and nightly jobs. v1 workflows move from v1.0.3; v2 workflows previously used v2.6.2 and now use the same v1.0.4 pin while keeping OAuth (firebolt-client-id / firebolt-client-secret) inputs unchanged.

lint-and-scan-actions.yml upgrades actionlint (reviewdog) to v1.80.2 and zizmor to v0.7.1 (newer default scanner with additional workflow security audits).

Nightly v1/v2 bump firebolt-db/action-slack-nightly-notify from v1.0.0 to v1.0.1 on failure notifications only.

^{Reviewed by Cursor Bugbot for commit d067356. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d067356. Configure here.}

[cursor]

v2 workflows downgraded to v1 action

High Severity

Dependabot replaced firebolt-db/integration-testing-setup@v2.6.2 with v1.0.4 in the v2 integration and nightly workflows. Those majors are different products: v1 needs firebolt-username/firebolt-password, while these jobs pass firebolt-client-id/firebolt-client-secret/account. The v1 action will fail on missing required inputs, so v2 setup and tests will not run.

Additional Locations (1)

• .github/workflows/nightly-v2.yml#L58-L59

 

^{Reviewed by Cursor Bugbot for commit d067356. Configure here.}