build(deps): bump the github-actions group across 1 directory with 2 updates - #29
Conversation
dependabot
Bot
added
dependencies
|
✅ Claude finished — see below for the result. View job run |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Clean, mechanical bump — nothing to flag.
Verified both pinned SHAs resolve exactly to their claimed tags: actions/checkout@3d3c42e = v7.0.1, actions/setup-node@8207627 = v7.0.0. Both are major version bumps (checkout 6→7, setup-node 6→7), but their release notes are internal (ESM migration, dependency bumps) with no breaking change to inputs/outputs this repository relies on. The one functional change in checkout v7 (blocking fork-PR checkout under pull_request_target/workflow_run) doesn't apply here — every workflow touched uses plain pull_request.
Scope is correctly limited to the github-actions group (actions/checkout, actions/setup-node); action.yml is untouched, consistent with .github/dependabot.yml excluding the pinned anthropics/claude-code-action upstream dependency from this group, so no "investigate and adapt" changes were expected here. Title and description are Dependabot's standard, accurate output — no rewrite needed.
Note for awareness rather than a blocker: both being major bumps means this won't auto-merge under the default DEPENDABOT_AUTOMERGE_LEVELS=patch,minor, so it'll need a manual merge unless that's been widened.
…updates Bumps the github-actions group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout) and [actions/setup-node](https://github.com/actions/setup-node). Updates `actions/checkout` from 6.1.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v6.1.0...3d3c42e) Updates `actions/setup-node` from 6.5.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@2499707...8207627) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
6d780e9 to
632f252
Compare
|
✅ Claude finished — see below for the result. View job run |
There was a problem hiding this comment.
Clean, mechanical bump — nothing to flag. This is the same commit (632f2523) already reviewed and approved above; re-verified independently rather than duplicating that review's content:
- Both pinned SHAs resolve exactly to their claimed version comments:
actions/checkout@3d3c42e→v7.0.1tag,actions/setup-node@8207627→v7.0.0tag (checked viagh api repos/.../git/refs/tags/...). - Repo-wide grep confirms no stray references to the old pins (
d23441a/249970729) were left in any workflow. - Both are major-version bumps, but nothing in this diff touches
action.ymlor any input/output this repository consumes — the changes are confined to five workflow files'uses:lines and version comments, consistent with.github/dependabot.ymlscoping this group toactions/checkout/actions/setup-nodeonly. - Title and description are Dependabot's standard output and are already accurate and specific — no rewrite needed.
Worth noting for awareness, not a blocker: per this repository's own DEPENDABOT_AUTOMERGE_LEVELS default (patch,minor), a major bump like this won't auto-merge and needs a manual merge unless that's been widened.
Nothing else to check — no other open PRs touch these workflow files.
|
🎉 This PR is included in version 1.1.2 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Bumps the github-actions group with 2 updates in the / directory: actions/checkout and actions/setup-node.
Updates
actions/checkoutfrom 6.1.0 to 7.0.1Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Updates
actions/setup-nodefrom 6.5.0 to 7.0.0Release notes
Sourced from actions/setup-node's releases.
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)