Found while fixing the same defect in fgm/envrun
(envrun#25). The dependabot config
here is byte-identical, so the same failure mode applies, and it has run longer
here because this repo uses more actions.
1. Dependabot silently drops updates
.github/dependabot.yml sets no open-pull-requests-limit, so it takes the
default of 5, and eight actions are in use. Worse, unmerged PRs keep holding
that quota: once five sit open, nothing new is proposed at all.
Every batch this repo has had is exactly five PRs:
Six of the last eight months produced no updates at all. The resulting lag, as
of 2026-08-23:
| action |
here |
latest |
codecov/codecov-action |
5.5.1 |
7.0.0 |
actions/setup-go |
6.2.0 |
7.0.0 |
actions/checkout |
6.0.2 |
7.0.1 |
actions/dependency-review-action |
4.8.2 |
5.0.0 |
step-security/harden-runner |
2.14.1 |
2.19.0 |
github/codeql-action |
4.32.0 |
4.37.8 |
ossf/scorecard-action |
2.4.3 |
2.4.4 |
peter-evans/create-pull-request |
8.1.0 |
8.1.1 |
Four of them a full major behind.
Fix, as merged in envrun — grouping makes the limit unreachable, and the raised
limit is belt and braces:
- package-ecosystem: github-actions
directory: /
schedule:
interval: "monthly"
open-pull-requests-limit: 10
groups:
github-actions:
patterns: ["*"]2. Codecov signing-key rotation (self-resolving, recorded for the record)
workflow.yml fails at the codecov upload with:
gpg: Signature made Thu Jul 9 01:37:57 2026 UTC
gpg: using RSA key 27034E7FDB850E0BBC2C62FF806BB28AED779869
gpg: Can't check signature: No public key
==> Could not verify signature. Please contact Codecov if problem continues
##[error]Process completed with exit code 1
fail_ci_if_error: true promotes that to a failed build.
This is not version lag as such: the codecov-action-6.0.0 branch passed on
2026-05-02 and fails today with the above. Codecov rotated the CLI signing key
around 2026-07-09, and only action releases shipping the new key still verify.
v7.0.0 works — envrun runs it and is green.
The lag did hide it: main had no push between 2026-04-05 and 2026-08-23, so
the first red run on main is today's merge of #124.
Dependabot has since regenerated #125 as 5.5.1 → 7.0.0, which resolves it.
The other open bump PRs fail the same way until they carry that change.
3. The Update cron does not do what its comment says
- cron: "0 2 1-7 * 6" # 2am UTC, monthly on the first Saturday of each month
When day-of-month and day-of-week are both restricted, cron ORs them. This
fires on days 1–7 of every month plus every Saturday. Run history for August
confirms it: the 1st through the 8th, then the 15th and the 22nd — ten runs
rather than one.
envrun fixed this by moving to a weekly cron plus a check-first-saturday.yml
job gate.
4. Tool dependencies are never updated
update.yml runs only go get -t -u ./..., which never touches the tool
directive. Both tool dependencies have been frozen since they were added in #99
on 2025-09-19:
honnef.co/go/tools v0.6.1 — envrun is on v0.8.1golang.org/x/tools v0.37.0 — envrun is on v0.49.0
envrun covers this with a second line, go get -u tool.
Related: go-version: ${{ env.GO_VERSION }} is hardcoded to 1.24 while
go.mod says go 1.24.7. envrun uses go-version-file: go.mod, which cannot
drift.
5. Minor
The Go Report Card badge on README line 4 is dead — the service shut down. It
was removed from envrun in 6111b88.
Items 3 and 4 are independent of the dependabot defect and could be split out if
that is easier to review.
Found while fixing the same defect in
fgm/envrun(envrun#25). The dependabot config
here is byte-identical, so the same failure mode applies, and it has run longer
here because this repo uses more actions.
1. Dependabot silently drops updates
.github/dependabot.ymlsets noopen-pull-requests-limit, so it takes thedefault of 5, and eight actions are in use. Worse, unmerged PRs keep holding
that quota: once five sit open, nothing new is proposed at all.
Every batch this repo has had is exactly five PRs:
Six of the last eight months produced no updates at all. The resulting lag, as
of 2026-08-23:
codecov/codecov-actionactions/setup-goactions/checkoutactions/dependency-review-actionstep-security/harden-runnergithub/codeql-actionossf/scorecard-actionpeter-evans/create-pull-requestFour of them a full major behind.
Fix, as merged in envrun — grouping makes the limit unreachable, and the raised
limit is belt and braces:
2. Codecov signing-key rotation (self-resolving, recorded for the record)
workflow.ymlfails at the codecov upload with:fail_ci_if_error: truepromotes that to a failed build.This is not version lag as such: the
codecov-action-6.0.0branch passed on2026-05-02 and fails today with the above. Codecov rotated the CLI signing key
around 2026-07-09, and only action releases shipping the new key still verify.
v7.0.0 works — envrun runs it and is green.
The lag did hide it:
mainhad no push between 2026-04-05 and 2026-08-23, sothe first red run on
mainis today's merge of #124.Dependabot has since regenerated #125 as 5.5.1 → 7.0.0, which resolves it.
The other open bump PRs fail the same way until they carry that change.
3. The Update cron does not do what its comment says
When day-of-month and day-of-week are both restricted, cron ORs them. This
fires on days 1–7 of every month plus every Saturday. Run history for August
confirms it: the 1st through the 8th, then the 15th and the 22nd — ten runs
rather than one.
envrun fixed this by moving to a weekly cron plus a
check-first-saturday.ymljob gate.
4. Tool dependencies are never updated
update.ymlruns onlygo get -t -u ./..., which never touches thetooldirective. Both tool dependencies have been frozen since they were added in #99
on 2025-09-19:
honnef.co/go/toolsv0.6.1 — envrun is on v0.8.1golang.org/x/toolsv0.37.0 — envrun is on v0.49.0envrun covers this with a second line,
go get -u tool.Related:
go-version: ${{ env.GO_VERSION }}is hardcoded to1.24whilego.modsaysgo 1.24.7. envrun usesgo-version-file: go.mod, which cannotdrift.
5. Minor
The Go Report Card badge on README line 4 is dead — the service shut down. It
was removed from envrun in
6111b88.Items 3 and 4 are independent of the dependabot defect and could be split out if
that is easier to review.