FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Bump j178/prek-action from 2.0.6 to 3.0.0 by dependabot[bot] · Pull Request #235 · learningequality/le-utils · GitHub

/ le-utils Public

Bump j178/prek-action from 2.0.6 to 3.0.0 - #235

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/j178/prek-action-3.0.0
ConversationCommits (1)ChecksFiles changed
Open

Bump j178/prek-action from 2.0.6 to 3.0.0#235
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/j178/prek-action-3.0.0

Conversation

dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps j178/prek-action from 2.0.6 to 3.0.0.

Release notes

Sourced from j178/prek-action's releases.

v3.0.0

prek-action releases are now immutable

Starting with v3, prek-action will no longer publish moving major or minor tags. References such as j178/prek-action@v3 and j178/prek-action@v3.0 will not be available.

Moving tags can be retargeted after users adopt them, creating unnecessary supply-chain risk. Use an exact release tag or, for stronger protection, pin the action to a full commit SHA.

[!TIP] Use an exact release tag:

- uses: j178/prek-action@v3.0.0

Or, even better, pin the full commit SHA:

- uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0

What's Changed

Full Changelog: j178/prek-action@v2...v3.0.0

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bump j178/prek-action from 2.0.6 to 3.0.0
1b2ea4e 
Bumps [j178/prek-action](https://github.com/j178/prek-action) from 2.0.6 to 3.0.0.
- [Release notes](https://github.com/j178/prek-action/releases)
- [Commits](j178/prek-action@v2.0.6...v3.0.0)

---
updated-dependencies:
- dependency-name: j178/prek-action
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 1, 2026

rtibblesbot commented Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🟡 Waiting for changes

Last updated: 2026-09-01 00:12 UTC

rtibblesbot reviewed Sep 1, 2026
View reviewed changes

rtibblesbot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

PR #235 — j178/prek-action 2.0.6 → 3.0.0, major bump, CI-only (lint workflow, no runtime impact). CI passing, including All file linting, which runs the new action.

  • Breaking change (not applicable): v3 stops publishing moving @v3 / @v3.0 tags (#170). This repo pins the exact tag, and grep -rn prek-action .github/ finds no other reference.
  • Security fixes / deprecations / peer deps: none.
  • Behavioral change: cache-key hashing fixed (#153) — hashConfigFiles now digests each config file's SHA-256 rather than streaming raw bytes. First run on main after merge is a cache miss, then self-heals.
  • Known checksums updated for prek 0.4.11, matching the pin from #232.
  • No code changes required; the action is invoked with no inputs.

One nitpick inline about SHA pinning.

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Ran a dependency-update review pipeline over the version bump:

  • Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
  • Extracted the changelog and release notes across the version range
  • Assessed compatibility with this project's usage and whether any code changes are required
  • Treated CI as the primary safety net
  • Scaled the review depth to the update's risk
  • Chose the verdict from semver risk, changelog findings, and CI status

Comment thread .github/workflows/pre-commit.yml
enable-cache: true
cache-python: true
- uses: j178/prek-action@v2.0.6
- uses: j178/prek-action@v3.0.0

rtibblesbot Sep 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

nitpick: The v3.0.0 notes recommend pinning the commit SHA now that tags are immutable:

- uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0

Dependabot maintains SHA pins and their trailing version comments the same way it maintains tags. Better as a separate repo-wide pass than inside a Dependabot PR — an exact release tag is already a reasonable stopping point.

This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
rtibblesbot rtibblesbot left review comments
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

Back | FazBrowse Home | New Git URL