What the developer wrote
Authored by Suheb
github: bump gateway code-review to v0.6.0
Bumps both pins together: the gateway-action SHA and the runtime_ref it
resolves. runtime_ref is pinned explicitly rather than left to the
action's default, so bumping only the action would leave the job on the
v0.5.0 runtime.
v0.6.0 adds no trigger and no input, so the rest of the shim is
unchanged.
What changed, and why it matters
This commit updates a GitHub Actions workflow that runs an optional code-review bot called 'gateway'. It only changes two pinned version numbers (SHA hashes) for the bot's action and its runtime, moving from v0.5.0 to v0.6.0. There is no change to triggers, inputs, or permissions. Based on the commit message and diff alone, this is a routine dependency bump with no visible security relevance.
No security action required. Treat as a routine CI/CD dependency update. If desired, review the gateway-action v0.6.0 release notes separately for any security fixes not mentioned in this commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change is in .github/workflows/gateway.yml. It bumps lightninglabs/gateway-action from SHA 3a31b86… (v0.5.0) to 334a845… (v0.6.0), and the corresponding runtime_ref from b7490e6… to 75f6e67… (gateway v0.6.0). The commit explicitly states that v0.6.0 adds no trigger and no input, and the rest of the shim is unchanged. The workflow remains comment-triggered only, with no pull_request triggers, and is gated to maintainers.
Changed components
.github/workflows/gateway.ymlInspect captured patch +4 / −4
diff --git a/.github/workflows/gateway.yml b/.github/workflows/gateway.yml
index 5e22aa1..0b8bf31 100644
--- a/.github/workflows/gateway.yml
+++ b/.github/workflows/gateway.yml
@@ -3,7 +3,7 @@ name: gateway
# Opt-in code-review bot. Triggered by a `/gateway <command>` comment on a PR
# (e.g. `/gateway review`); review/approve commands are gated to maintainers.
# Comment-commands only — no pull_request triggers — so fork PRs (which receive
-# no secrets) never spawn failing runs. v0.5.0 adds the
+# no secrets) never spawn failing runs. v0.5.0 added the
# pull_request_review_comment trigger: /gateway dismiss, promote, and explain
# now also work as replies on a finding's inline thread (finding id inferred
# from the thread when omitted). Also a comment event — same fork-PR safety
@@ -43,12 +43,12 @@ jobs:
env:
GATEWAY_REVIEW_MODE: multi
steps:
- - uses: lightninglabs/gateway-action@3a31b86adf442852801a04ddb9c6bc0f12d363da # v0.5.0
+ - uses: lightninglabs/gateway-action@334a8455ee316e40668ae3ac85249150c62704ec # v0.6.0
with:
# Pin the private runtime to an immutable commit (matches the action
# SHA-pin above) so runtime upgrades go through an lnd PR, not a moved
- # tag. Without this, runtime_ref defaults to the v0.5.0 tag.
- runtime_ref: b7490e68db31b391becfe9534e947b8004fc518b # gateway v0.5.0
+ # tag. Without this, runtime_ref defaults to the v0.6.0 tag.
+ runtime_ref: 75f6e67deac362bdcfc10d10629ddcf69c0e2615 # gateway v0.6.0
event_name: ${{ github.event_name }}
event_action: ${{ github.event.action }}
repo: ${{ github.repository }}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.