From 4cdccb97a02d32083ccd121ee29ba76b05ea14b9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 8 Jun 2026 03:10:15 +0000 Subject: [PATCH 1/2] ci(deps): bump codecov/codecov-action in the deploy-stack group Bumps the deploy-stack group with 1 update: [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `codecov/codecov-action` from 6 to 7 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codecov/codecov-action/compare/v6...v7) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: deploy-stack ... Signed-off-by: dependabot[bot] --- .github/workflows/deploy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 6dc47c4..133103b 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -59,7 +59,7 @@ jobs: run: ./tool/coverage.sh 90 - name: Upload coverage - uses: codecov/codecov-action@v6 + uses: codecov/codecov-action@v7 with: files: coverage/lcov.info fail_ci_if_error: false From 5e70b53b689367cff01ed5345159596492fdee59 Mon Sep 17 00:00:00 2001 From: Anilcan Cakir Date: Mon, 8 Jun 2026 16:36:18 +0300 Subject: [PATCH 2/2] ci(deps): pin codecov-action@v7 to commit SHA Dependabot bumped codecov/codecov-action v6->v7 as a tag, which trips the zizmor/unpinned-uses blanket policy. Pin to the v7.0.0 commit SHA (matching the tailscale/github-action precedent) so the security gate passes. --- .github/workflows/deploy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 133103b..aeeb841 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -59,7 +59,7 @@ jobs: run: ./tool/coverage.sh 90 - name: Upload coverage - uses: codecov/codecov-action@v7 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: files: coverage/lcov.info fail_ci_if_error: false