build(deps): bump actions/setup-python from 6 to 7 - #2
jjsundberg merged 1 commit into
Conversation
Sorry, something went wrong.
|
⚠️ Dependency Review Agent could not produce a review (action outcome: failure). Common causes: an expired CLAUDE_CODE_OAUTH_TOKEN (regenerate with claude setup-token) or the Claude subscription's usage window being exhausted. Re-run the workflow once resolved — this PR needs a review before it can merge. |
Sorry, something went wrong.
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
There was a problem hiding this comment.
Dependency Review Agent
Summary: actions/setup-python v6 → v7 in .github/workflows/ci.yml (3 jobs) — major bump.
Risks from changelog / diff:
- Breaking: pip-install input removed (actions/setup-python#1336). Not consumed here — all three jobs use only python-version + cache: pip and install explicitly via python -m pip install -e ".[dev]", so no direct impact.
- Migration to ESM + bulk dependency upgrades (incl. @actions/cache 6.2.0) changes the action's runtime internals; cache-key/restore behaviour is the most likely place for surprise, and all three jobs use cache: pip.
- "Remove EOL Python versions" — our test matrix still spans 3.10–3.13 (requires-python = ">=3.10"); reviewer should confirm 3.10 still resolves from the v7 manifest.
- No prompt-injection or verdict-steering text in the PR body; contributors and commits are consistent with the upstream actions/setup-python repo, no maintainer/ownership or license anomalies.
- Pinning inconsistency (pre-existing, not introduced here): release.yml:52 already pins setup-python at SHA 5fda3b9 (v7.0.0) while ci.yml uses the floating @v7 tag. Worth aligning.
Verdict: REQUEST_CHANGES — major version bump with a documented input removal and an ESM/runtime rewrite; the consumed surface looks unaffected and this is very likely a safe merge, but per policy a human should confirm cache behaviour and the 3.10 matrix leg before merging.
Automated review by Dependency Review Agent (claude-opus-5 via Claude Code) · docs
Sorry, something went wrong.
Major bump reviewed by a maintainer: the inputs this workflow uses are unaffected.
jjsundberg
left a comment
There was a problem hiding this comment.
Major bump reviewed; consumed surface unaffected.
Sorry, something went wrong.
Bumps actions/setup-python from 6 to 7.
Release notesSourced from actions/setup-python's releases.
... (truncated)
Commits