Bump andrewslotin/go-proxy-pull-action from 1.3.0 to 1.4.0

[dependabot]

Bumps andrewslotin/go-proxy-pull-action from 1.3.0 to 1.4.0.

Release notes

Sourced from andrewslotin/go-proxy-pull-action's releases.

v1.4.0

What's Changed

• Update Dockerfile to Go 1.25 by @​wolf31o2 in andrewslotin/go-proxy-pull-action#13

Full Changelog: andrewslotin/go-proxy-pull-action@v1.3.0...v1.4.0

Commits

• e5aea3b Merge pull request #13 from wolf31o2/fix/go-1.25
• eee4b5d Update Dockerfile to Go 1.25
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[senzingdevops]

Automated: approving this pull request because it includes a minor update

[github-actions]

🤖 Claude Code Review

PR Code Review

Change Summary: Bumps andrewslotin/go-proxy-pull-action from v1.3.0 to v1.4.0 in .github/workflows/go-proxy-pull.yaml.

---

Code Quality

• ✅ Style guide: Single-line version bump in a YAML workflow file — no style concerns.
• ✅ No commented-out code: None present.
• ✅ Meaningful variable names: N/A.
• ✅ DRY principle: N/A.
• ✅ Defects: No logic errors or bugs introduced. This is a dependency version bump by Dependabot.
• ✅ CLAUDE.md: No issues; this change is unrelated to local dev configuration.

Testing

• ✅ Unit/integration tests: Not applicable for a CI workflow action version bump.

Documentation

• ✅ README: No update needed.
• ✅ API docs: N/A.
• ✅ CHANGELOG.md: Not required for automated dependency bumps.
• ✅ Markdown formatting: N/A.

Security

• ✅ No hardcoded credentials: None.
• ✅ No license files: None present.
• ⚠️ Pinning strategy: The action is pinned to a mutable tag (v1.4.0) rather than an immutable commit SHA. For supply chain security, pinning to a full commit SHA (e.g., andrewslotin/go-proxy-pull-action@<sha>) is the more hardened approach. This is a low-risk workflow (Go module proxy pull), but worth noting as a pattern to consider for all actions in the repo.

---

Verdict: Approved. The version bump is straightforward and low-risk. The only non-blocking observation is the use of a mutable tag instead of a commit SHA, which is a general supply chain hygiene concern applicable across the repo's workflows, not specific to this PR.

Automated code review analyzing defects and coding standards

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter