chore(deps): bump the github-actions group across 1 directory with 9 updates - #2636
Conversation
Sorry, something went wrong.
|
|
||
| - name: Create pull request | ||
| uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v7 | ||
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7 |
There was a problem hiding this comment.
🟡 The trailing comment on this line still reads # v7, but the SHA 5f6978f corresponds to peter-evans/create-pull-request v8.1.1 (per the Dependabot description). This is a pre-existing inaccuracy — the old SHA was already v8.1.0 with the same # v7 comment — and Dependabot won't auto-correct it because it only rewrites comments that match a full-semver pattern. Since this line is being touched anyway, consider updating the comment to # v8.1.1 so it tracks correctly on future bumps.
Extended reasoning...What the bug is. In .github/workflows/weekly-lockfile-update.yml line 32, the action pin was bumped from c0f553fe549906ede9cf27b5156039d195d2ece0 to 5f6978faf089d4d20b00c7766989d076bb2fc7f1, but the trailing version comment still says # v7. According to the Dependabot PR description, this bump is peter-evans/create-pull-request 8.1.0 → 8.1.1, so the SHA actually corresponds to v8.1.1 — a full major version newer than what the comment claims.
Why Dependabot didn't fix it. Dependabot rewrites the trailing version comment when it recognizes the existing comment as the version it is replacing (a full vX.Y.Z string matching the old version). Here the pre-existing comment was # v7, which didn't match the old version v8.1.0, so Dependabot preserved it verbatim — the same way it preserved # release/v1 on the pypa/gh-action-pypi-publish pin in this PR. This means the comment will keep being left as # v7 on every future bump until someone manually corrects it to a proper full-semver comment.
This is pre-existing. The comment was already wrong before this PR: c0f553fe... is v8.1.0, and the line said # v7 then too. This PR did not introduce the staleness; it just carried it forward. It is also worth noting that contrary to first impressions, not every other pin's comment was updated in this PR — pypa/gh-action-pypi-publish retained its # release/v1 comment for the same reason.
Impact. The SHA pin is what actually executes, so there is zero functional impact. But the entire point of putting a human-readable version comment next to an opaque SHA pin is so reviewers can audit at a glance. A reviewer auditing this workflow would be told they're running v7 of create-pull-request when they're actually running v8.1.1 — two major versions off. That defeats the purpose of the comment and could mislead someone reasoning about which features or breaking changes apply.
How to fix. Change the comment to # v8.1.1 (the exact version corresponding to the pinned SHA). Once the comment matches a full-semver string, Dependabot will keep it in sync automatically on future bumps. Note that hand-editing a Dependabot PR is normally avoided since it can interfere with auto-rebase — an alternative is to land this PR as-is and apply the one-character comment fix in a tiny follow-up.
Step-by-step proof:
- The diff line 32 changes uses: peter-evans/create-pull-request@c0f553fe... # v7 to uses: peter-evans/create-pull-request@5f6978f... # v7 — only the SHA changed, not the comment.
- The Dependabot PR description states: peter-evans/create-pull-request 8.1.0 → 8.1.1, with commit link peter-evans/create-pull-request/commit/5f6978faf089d4d20b00c7766989d076bb2fc7f1 listed under v8.1.1.
- Therefore the SHA on line 32 is v8.1.1, but the comment claims v7 — the comment is stale by a full major version.
- Compare to actions/checkout lines elsewhere in this PR: # v4.3.1 → # v6.0.2. Those comments were updated because the old comment exactly matched the old version, which Dependabot recognizes and rewrites. # v7 did not match v8.1.0, so it was left alone.
Sorry, something went wrong.
…updates Bumps the github-actions group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.3.1` | `6.0.3` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.53` | `1.0.148` | | [actions/github-script](https://github.com/actions/github-script) | `8.0.0` | `9.0.0` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `7.2.1` | `8.2.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.2.0` | `6.4.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6.0.0` | `7.0.1` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `7.0.0` | `8.0.1` | | [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.13.0` | `1.14.0` | | [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `8.1.0` | `8.1.1` | Updates `actions/checkout` from 4.3.1 to 6.0.3 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4.3.1...df4cb1c) Updates `anthropics/claude-code-action` from 1.0.53 to 1.0.148 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@2f8ba26...d5726de) Updates `actions/github-script` from 8.0.0 to 9.0.0 - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@ed59741...3a2844b) Updates `astral-sh/setup-uv` from 7.2.1 to 8.2.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@803947b...fac544c) Updates `actions/setup-node` from 6.2.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@6044e13...48b55a0) Updates `actions/upload-artifact` from 6.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@b7c566a...043fb46) Updates `actions/download-artifact` from 7.0.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@37930b1...3e5f45b) Updates `pypa/gh-action-pypi-publish` from 1.13.0 to 1.14.0 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@ed0c539...cef2210) Updates `peter-evans/create-pull-request` from 8.1.0 to 8.1.1 - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](peter-evans/create-pull-request@c0f553f...5f6978f) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: anthropics/claude-code-action dependency-version: 1.0.123 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: 8.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: peter-evans/create-pull-request dependency-version: 8.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
|
This pull request is included in pre-release v2.0.0a2 |
Sorry, something went wrong.
Bumps the github-actions group with 9 updates in the / directory:
Updates actions/checkout from 4.3.1 to 6.0.3
Release notesSourced from actions/checkout's releases.
... (truncated)
ChangelogSourced from actions/checkout's changelog.
... (truncated)
CommitsUpdates anthropics/claude-code-action from 1.0.53 to 1.0.148
Release notesSourced from anthropics/claude-code-action's releases.
... (truncated)
CommitsUpdates actions/github-script from 8.0.0 to 9.0.0
Release notesSourced from actions/github-script's releases.
CommitsUpdates astral-sh/setup-uv from 7.2.1 to 8.2.0
Release notesSourced from astral-sh/setup-uv's releases.
... (truncated)
CommitsUpdates actions/setup-node from 6.2.0 to 6.4.0
Release notesSourced from actions/setup-node's releases.
CommitsUpdates actions/upload-artifact from 6.0.0 to 7.0.1
Release notesSourced from actions/upload-artifact's releases.
CommitsUpdates actions/download-artifact from 7.0.0 to 8.0.1
Release notesSourced from actions/download-artifact's releases.
CommitsUpdates pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0
Release notesSourced from pypa/gh-action-pypi-publish's releases.
CommitsUpdates peter-evans/create-pull-request from 8.1.0 to 8.1.1
Release notesSourced from peter-evans/create-pull-request's releases.
CommitsDescription has been truncated