chore: update CI workflows versions by mwirikia · Pull Request #79 · ONS-Innovation/github-copilot-usage-lambda

mwirikia · 2026-06-09T07:48:30Z

What type of PR is this? (check all applicable)

What

Update CI workflows versions to fixed hash for consistency and upgrade MegaLinter to version 9.5.0 to leverage the latest features and improvements. No new tests or documentation are necessary as these changes are related to configuration updates.

Testing

Have any new tests been added as part of this issue? If not, try to explain why test coverage is not needed here.

Yes
No
Please write a brief description of why test coverage is not necessary here.
Not as part of this ticket. (Could be done at a later point)

Documentation

Has any new documentation been written as part of this issue? We should try to keep documentation up to date
as new code is added, rather than leaving it for the future.

Yes
No
Please write a brief description of why documentation is not necessary here.
Not as part of this ticket. (Could be done at a later point)

Related issues

Provide links to any related issues.

How to review

Describe the steps required to test the changes.

…alinter to v 9.5.0

github-actions · 2026-06-09T07:52:51Z

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
❌ ACTION	zizmor	3	21	0	2.06s
⚠️ BASH	bash-exec	6	4	0	0.02s
✅ BASH	shellcheck	6	0	0	0.15s
✅ BASH	shfmt	6	0	0	0.27s
✅ CSHARP	csharpier	1	0	0	0.98s
✅ DOCKERFILE	hadolint	1	0	0	0.14s
✅ JSON	jsonlint	2	0	0	0.17s
✅ JSON	prettier	2	0	0	0.63s
✅ JSON	v8r	2	0	0	6.79s
✅ MARKDOWN	markdownlint	6	0	0	0.92s
✅ REPOSITORY	checkov	yes	no	no	25.19s
✅ REPOSITORY	dustilock	yes	no	no	0.03s
✅ REPOSITORY	gitleaks	yes	no	no	15.95s
❌ REPOSITORY	grype	yes	3	no	63.29s
✅ REPOSITORY	kingfisher	yes	no	no	12.23s
❌ REPOSITORY	osv-scanner	yes	3	no	0.9s
✅ REPOSITORY	secretlint	yes	no	no	1.29s
✅ REPOSITORY	syft	yes	no	no	2.93s
❌ REPOSITORY	trivy	yes	1	no	14.75s
✅ REPOSITORY	trivy-sbom	yes	no	no	0.39s
✅ TERRAFORM	terraform-fmt	6	0	0	1.02s
❌ YAML	prettier	8	1	2	1.04s
✅ YAML	v8r	8	0	0	10.4s
❌ YAML	yamllint	8	4	0	1.32s

Detailed Issues

❌ REPOSITORY / grype - 3 errors

[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) from=syft
NAME                INSTALLED  FIXED IN  TYPE    VULNERABILITY        SEVERITY  EPSS        RISK   
pygments            2.19.2     2.20.0    python  GHSA-5239-wwwm-4pmq  Low       0.2% (5th)  < 0.1  
cryptography        46.0.7     48.0.1    python  GHSA-537c-gmf6-5ccf  High      N/A         N/A    
pymdown-extensions  10.16.1    10.21.3   python  GHSA-62q4-447f-wv8h  Medium    N/A         N/A
[0063] ERROR discovered vulnerabilities at or above the severity threshold

❌ REPOSITORY / osv-scanner - 3 errors

Scanning dir .
Starting filesystem walk for root: /
Scanned poetry.lock file and found 61 packages
End status: 35 dirs visited, 117 inodes visited, 1 Extract calls, 15.04137ms elapsed, 15.041561ms wall time

Total 3 packages affected by 3 known vulnerabilities (0 Critical, 1 High, 1 Medium, 1 Low, 0 Unknown) from 1 ecosystem.
3 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+--------------------+---------+---------------+-------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE            | VERSION | FIXED VERSION | SOURCE      |
+-------------------------------------+------+-----------+--------------------+---------+---------------+-------------+
| https://osv.dev/GHSA-537c-gmf6-5ccf | 7.5  | PyPI      | cryptography       | 46.0.7  | 48.0.1        | poetry.lock |
| https://osv.dev/GHSA-5239-wwwm-4pmq | 3.3  | PyPI      | pygments (dev)     | 2.19.2  | 2.20.0        | poetry.lock |
| https://osv.dev/GHSA-62q4-447f-wv8h | 4.3  | PyPI      | pymdown-extensions | 10.16.1 | 10.21.3       | poetry.lock |
+-------------------------------------+------+-----------+--------------------+---------+---------------+-------------+

❌ YAML / prettier - 1 error

Checking formatting...
[warn] mkdocs.yml
[warn] Code style issues found in the above file. Run Prettier with --write to fix.

❌ REPOSITORY / trivy - 1 error

MiB p/s ETA 0s96.56 MiB / 96.56 MiB [---------------------------------------------->] 100.00% 83.72 MiB p/s ETA 0s96.56 MiB / 96.56 MiB [---------------------------------------------->] 100.00% 83.72 MiB p/s ETA 0s96.56 MiB / 96.56 MiB [---------------------------------------------->] 100.00% 78.32 MiB p/s ETA 0s96.56 MiB / 96.56 MiB [---------------------------------------------->] 100.00% 78.32 MiB p/s ETA 0s96.56 MiB / 96.56 MiB [---------------------------------------------->] 100.00% 78.32 MiB p/s ETA 0s96.56 MiB / 96.56 MiB [---------------------------------------------->] 100.00% 73.27 MiB p/s ETA 0s96.56 MiB / 96.56 MiB [---------------------------------------------->] 100.00% 73.27 MiB p/s ETA 0s96.56 MiB / 96.56 MiB [---------------------------------------------->] 100.00% 73.27 MiB p/s ETA 0s96.56 MiB / 96.56 MiB [---------------------------------------------->] 100.00% 68.54 MiB p/s ETA 0s96.56 MiB / 96.56 MiB [---------------------------------------------->] 100.00% 68.54 MiB p/s ETA 0s96.56 MiB / 96.56 MiB [---------------------------------------------->] 100.00% 68.54 MiB p/s ETA 0s96.56 MiB / 96.56 MiB [---------------------------------------------->] 100.00% 64.12 MiB p/s ETA 0s96.56 MiB / 96.56 MiB [---------------------------------------------->] 100.00% 64.12 MiB p/s ETA 0s96.56 MiB / 96.56 MiB [---------------------------------------------->] 100.00% 64.12 MiB p/s ETA 0s96.56 MiB / 96.56 MiB [---------------------------------------------->] 100.00% 59.98 MiB p/s ETA 0s96.56 MiB / 96.56 MiB [---------------------------------------------->] 100.00% 59.98 MiB p/s ETA 0s96.56 MiB / 96.56 MiB [-------------------------------------------------] 100.00% 15.48 MiB p/s 6.4s2026-06-18T10:17:48Z	INFO	[vulndb] Artifact successfully downloaded	repo="mirror.gcr.io/aquasec/trivy-db:2"
2026-06-18T10:17:48Z	INFO	[vuln] Vulnerability scanning is enabled
2026-06-18T10:17:48Z	INFO	[misconfig] Misconfiguration scanning is enabled
2026-06-18T10:17:48Z	INFO	[checks-client] Need to update the checks bundle
2026-06-18T10:17:48Z	INFO	[checks-client] Downloading the checks bundle...
234.65 KiB / 234.65 KiB [------------------------------------------------------] 100.00% ? p/s 200ms2026-06-18T10:17:52Z	INFO	[terraform scanner] Scanning root module	file_path="terraform"
2026-06-18T10:17:52Z	WARN	[terraform parser] Variable values were not found in the environment or variable files. Evaluating may not work correctly.	module="root" variables="aws_access_key_id, aws_account_id, aws_secret_access_key, aws_secret_name, github_app_client_id"
2026-06-18T10:17:53Z	INFO	Suppressing dependencies for development and testing. To display them, try the '--include-dev-deps' flag.
2026-06-18T10:17:53Z	INFO	Number of language-specific files	num=1
2026-06-18T10:17:53Z	INFO	[poetry] Detecting vulnerabilities...
2026-06-18T10:17:53Z	INFO	Detected config files	num=4

Report Summary

┌───────────────────┬────────────┬─────────────────┬───────────────────┐
│      Target       │    Type    │ Vulnerabilities │ Misconfigurations │
├───────────────────┼────────────┼─────────────────┼───────────────────┤
│ poetry.lock       │   poetry   │        1        │         -         │
├───────────────────┼────────────┼─────────────────┼───────────────────┤
│ Dockerfile        │ dockerfile │        -        │         0         │
├───────────────────┼────────────┼─────────────────┼───────────────────┤
│ catalog-info.yaml │ kubernetes │        -        │         0         │
├───────────────────┼────────────┼─────────────────┼───────────────────┤
│ terraform         │ terraform  │        -        │         0         │
├───────────────────┼────────────┼─────────────────┼───────────────────┤
│ terraform/main.tf │ terraform  │        -        │         0         │
└───────────────────┴────────────┴─────────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.70/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


poetry.lock (poetry)
====================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

┌──────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────┐
│   Library    │    Vulnerability    │ Severity │ Status │ Installed Version │ Fixed Version │                       Title                        │
├──────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────┤
│ cryptography │ GHSA-537c-gmf6-5ccf │ HIGH     │ fixed  │ 46.0.7            │ 48.0.1        │ Vulnerable OpenSSL included in cryptography wheels │
│              │                     │          │        │                   │               │ https://github.com/advisories/GHSA-537c-gmf6-5ccf  │
└──────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────┘

📣 Notices:
  - Version 0.71.1 of Trivy is now available, current version is 0.70.0

To suppress version checks, run Trivy scans with the --skip-version-check flag

(Truncated to last 5714 characters out of 7518)

❌ YAML / yamllint - 4 errors

.checkov.yml
  25:4      warning  missing starting space in comment  (comments)

.github/workflows/deploy_mkdocs.yml
  4:1       warning  truthy value should be one of [false, true]  (truthy)

concourse/ci.yml
  33:3      warning  comment not indented like content  (comments-indentation)

mkdocs.yml
  11:5      error    wrong indentation: expected 6 but found 4  (indentation)

❌ ACTION / zizmor - 21 errors

INFO zizmor: 🌈 zizmor v1.25.0
 INFO audit: zizmor: 🌈 completed .github/workflows/ci.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/deploy_mkdocs.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/megalinter.yml
warning[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/deploy_mkdocs.yml:15:9
   |
15 |       - uses: actions/checkout@HIDDEN_BY_MEGALINTER# v4
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

21 findings (20 suppressed, 1 unsafe fixes): 0 informational, 0 low, 1 medium, 0 high

⚠️ BASH / bash-exec - 4 errors

Results of bash-exec linter (version 5.3.3)
See documentation on https://megalinter.io/9.5.0/descriptors/bash_bash_exec/
-----------------------------------------------

❌ [ERROR] concourse/scripts/assume_role.sh
    Error: File:[concourse/scripts/assume_role.sh] is not executable

✅ [SUCCESS] concourse/scripts/build_image.sh
✅ [SUCCESS] concourse/scripts/set_pipeline.sh
❌ [ERROR] concourse/scripts/terraform_infra.sh
    Error: File:[concourse/scripts/terraform_infra.sh] is not executable

❌ [ERROR] shell_scripts/md_fix.sh
    Error: File:[shell_scripts/md_fix.sh] is not executable

❌ [ERROR] shell_scripts/md_lint.sh
    Error: File:[shell_scripts/md_lint.sh] is not executable

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

Documentation: Custom Flavors
Command: npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters ACTION_ZIZMOR,BASH_EXEC,BASH_SHELLCHECK,BASH_SHFMT,CSHARP_CSHARPIER,DOCKERFILE_HADOLINT,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,REPOSITORY_CHECKOV,REPOSITORY_DUSTILOCK,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_KINGFISHER,TERRAFORM_TERRAFORM_FMT,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository

chore: update action versions in CI workflows for consistency and meg…

924ed78

…alinter to v 9.5.0

mwirikia added 9 commits June 9, 2026 12:38

add GITHUB_TOKEN MegaLinter config

4d57d50

add false persistance

e6e2cc7

update files to resolve errors

c0bd083

linting scan updates

1d6a0e9

update dep and lock

babdb5a

check mkdocs update work

a4ee3d8

rm team_usage.md

d467fc1

Nav update

39893a8

remove unnecessary persist-credentials option from checkout step

6a250e3

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: update CI workflows versions#79

chore: update CI workflows versions#79
mwirikia wants to merge 10 commits into
mainfrom
KEH-2326_zizmor_update

mwirikia commented Jun 9, 2026

Uh oh!

github-actions Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

mwirikia commented Jun 9, 2026

What type of PR is this? (check all applicable)

What

Testing

Documentation

Related issues

How to review

Uh oh!

github-actions Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌MegaLinter analysis: Error

Detailed Issues

Notices

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Jun 9, 2026 •

edited

Loading