Pin dependencies (main)

[red-hat-konflux]

This PR contains the following updates:

Package	Type	Update	Change
conforma/.fullsend	action	pinDigest	→ 87c4a29
conforma/github-workflows	action	pinDigest	→ e049ae9
conforma/pr-size-label-action	action	pinDigest	→ 9bff907

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:50 AM UTC · Completed 2:00 AM UTC

Commit: 87c4a29 · View workflow run →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
acceptance	54.42% <ø> (+<0.01%)	⬆️
generative	16.36% <ø> (ø)
integration	27.58% <ø> (ø)
unit	71.97% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Review

Findings

High

• [protected-path] .github/workflows/auto-merge.yaml — This PR modifies 4 files under the .github/ protected path: .github/workflows/auto-merge.yaml, .github/workflows/checks-codecov.yaml, .github/workflows/fullsend.yaml, .github/workflows/label-pr-size.yaml. The changes pin GitHub Actions references from mutable branch/tag refs (@main, @v1.2.0) to immutable commit SHA digests — a supply-chain security improvement. However, the PR has no linked issue providing explicit authorization for modifying governance and infrastructure files. Human approval is always required for protected-path changes.
  Remediation: A repository maintainer should verify the pinned commit SHAs correspond to the expected versions (e049ae9 for conforma/github-workflows@main, 87c4a29 for conforma/.fullsend@main, 9bff907 for conforma/pr-size-label-action@v1.2.0) and approve.

---

Labels: PR modifies GitHub Actions workflow files to pin dependency digests

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

See the review comment for full details.