opentelemetry-dart: GitHub Actions Bumps and Security Workflow Updates

The opentelemetry-dart SDK for Dart had a slow week. Exactly one commit landed in the last seven days, and it touches no Dart code at all. The change is still worth a look if you copy CI patterns from this repo, since it updates pinned security tooling in three workflow files. I read the diff so you do not have to.

One pull request, three workflow files

The maintainers merged the GitHub Actions update (#16) on November 4. The commit, a routine renovate bot action version bump, changed 3 files with 4 insertions and 4 deletions. Everything else in the repo stayed still this week.

The files that changed:

• .github/workflows/codeql.yml
• .github/workflows/scorecard.yml
• .github/workflows/zizmor.yml

CodeQL moves to 4.39.2

The CodeQL workflow now pins github/codeql-action to 1fc58d04, tagged v4.39.2, up from v4.39.1. Because this repo pins actions by full commit SHA rather than by tag, the update touches three separate uses: lines: init, analyze, and upload-sarif. All three must point at the same digest or the workflow picks up mixed versions, so the renovate bot rewrites them together.

If you mirror this repo’s CodeQL setup, note the small details worth keeping:

• persist-credentials: false on checkout, so jobs do not carry repo credentials into analysis steps
• A matrix block driving languages and build-mode per job
• A category field on analysis, which keeps uploaded SARIF results separated per language

Zizmor workflow rebase onto shared-workflows 0.24.0

The third file is more interesting. The zizmor.yml workflow is not maintained in this repo. It calls a reusable workflow from open-telemetry/shared-workflows, pinned to f09a36e... (v0.23.0) before this change and efc5583... (v0.24.0) after. That is the OpenTelemetry community pattern: one shared zizmor configuration for every language repo, bumped centrally and rolled out repo by repo.

Zizmor itself scans GitHub Actions workflows for security problems: pinned actions, overbroad permissions, script injection risks. The permissions in this workflow are already tight, contents: read and security-events: write, which is what zizmor wants to see. The update just keeps the scanner current.

Why pinning matters here

This commit is housekeeping, but it shows the supply chain posture of the repo. Every third party action is pinned by commit SHA, and the OpenTelemetry Scorecard workflow uploads SARIF results to the code scanning dashboard. Renovate keeps the pins current without manual review of every patch version. For a Dart SDK, the runnable code lives with the maintainers, but CI actions run with broad repo permissions, so keeping those pinned and fresh is the part that actually reduces risk.

What to watch

Two things to track going forward:

• The v0.24.0 shared-workflows pin. If other OpenTelemetry repos report zizmor findings after the bump, expect a follow up PR here to match.
• No Dart source changes landed this week. If you were waiting on API work, check the open pull requests on the repo instead of the commit log. A quiet week does not mean the project stalled; it means the merge window was empty.