Bump senzing-factory/github-action-install-senzing-sdk from 4 to 5 in the senzing-factory group

[dependabot]

Bumps the senzing-factory group with 1 update: senzing-factory/github-action-install-senzing-sdk.

Updates senzing-factory/github-action-install-senzing-sdk from 4 to 5

Release notes

Sourced from senzing-factory/github-action-install-senzing-sdk's releases.

5.0.0

What's Changed

• #47 #48 support prod/staging homebrew install by @​kernelsam in senzing-factory/github-action-install-senzing-sdk#52
• #49 #50 scoop support by @​kernelsam in senzing-factory/github-action-install-senzing-sdk#53
• Bump actions/create-github-app-token from 2 to 3.1.1 by @​dependabot[bot] in senzing-factory/github-action-install-senzing-sdk#54

Full Changelog: senzing-factory/github-action-install-senzing-sdk@v4...5.0.0

4.0.5

What's Changed

• #44 add openssl3 to the DYLD_LIBRARY_PATH by @​kernelsam in senzing-factory/github-action-install-senzing-sdk#46

Full Changelog: senzing-factory/github-action-install-senzing-sdk@v4...4.0.5

4.0.4

What's Changed

• #44 add temporary openssl3 workaround by @​kernelsam in senzing-factory/github-action-install-senzing-sdk#45

Full Changelog: senzing-factory/github-action-install-senzing-sdk@v4...4.0.4

4.0.3

What's Changed

• #42 Fix APT dependency conflict when installing specific SDK versions by @​kernelsam in senzing-factory/github-action-install-senzing-sdk#43

Full Changelog: senzing-factory/github-action-install-senzing-sdk@v4...4.0.3

4.0.2

What's Changed

• windows requires inconsistencies by @​kernelsam in senzing-factory/github-action-install-senzing-sdk#41

Full Changelog: senzing-factory/github-action-install-senzing-sdk@v4...4.0.2

4.0.1

What's Changed

• #38 treat the interpolated path as a literal string rather than trying to… by @​kernelsam in senzing-factory/github-action-install-senzing-sdk#40

Full Changelog: senzing-factory/github-action-install-senzing-sdk@v4...4.0.1

Changelog

Sourced from senzing-factory/github-action-install-senzing-sdk's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog], [markdownlint], and this project adheres to [Semantic Versioning].

[Unreleased]

Commits

• 2079b74 fix brew auth and scoop path (#55)
• c129203 Bump actions/create-github-app-token from 2 to 3.1.1 (#54)
• af196d7 #49 #50 scoop support (#53)
• cff7810 #47 #48 support prod/staging homebrew install (#52)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

🤖 Claude Code Review

Code Review

Summary: This PR bumps senzing-factory/github-action-install-senzing-sdk from @v4 to @v5 across 7 GitHub Actions workflow files.

---

Code Quality

✅ Style guide — YAML formatting is consistent and unchanged.

✅ No commented-out code — None present.

✅ Meaningful variable names — N/A for this change.

⚠️ DRY principle — The action version is repeated across 7 files with no centralization. This is a pre-existing pattern and not introduced by this PR, but worth noting: a shared/reusable workflow or a workflow-level variable would make future version bumps a one-line change.

✅ Defects — The version bump is applied consistently across all 7 affected workflow files. No logic errors.

⚠️ Security: Mutable action tag — Both before and after, workflows pin to a mutable tag (@v4 → @v5) rather than an immutable commit SHA. If the upstream tag is force-pushed, CI runs a different version without any PR. Best practice per GitHub's hardening guide is to pin to a full SHA (e.g., senzing-factory/github-action-install-senzing-sdk@<sha>). This is not a regression introduced here, but worth fixing.

---

Testing

✅ No code logic changed — No unit/integration tests required for a CI action version bump.

---

Documentation

⚠️ CHANGELOG.md — Not included in the diff. If this project maintains a changelog, a dependency bump entry is typically expected.

✅ README / API docs — No changes required for a CI-only bump.

---

Security

✅ No hardcoded credentials — None present.

✅ No sensitive data in logs — N/A.

✅ No license files (.lic / AQAAAD strings) — None present.

---

Additional Observation

There is no Python workflow in this diff. If a Python CI workflow exists and also uses github-action-install-senzing-sdk@v4, it would need a matching update. Worth verifying that no workflow was missed.

---

Overall: Low-risk, straightforward dependency bump. The two items to address are the mutable tag pinning (security hardening, pre-existing) and confirming CHANGELOG is updated.

Automated code review analyzing defects and coding standards

[github-actions]

Super-linter summary

Language	Validation result
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

All files and directories linted successfully

For more information, see the GitHub Actions workflow run

Powered by Super-linter