build(deps): bump azure/login from 3.0.2 to 3.1.0 - #2014
Conversation
Bumps [azure/login](https://github.com/azure/login) from 3.0.2 to 3.1.0. - [Release notes](https://github.com/azure/login/releases) - [Commits](Azure/login@7ddb5af...a641126) --- updated-dependencies: - dependency-name: azure/login dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Looks good, straightforward dependency version bump.
What was reviewed: the single-line change in .github/workflows/release.yml that updates the pinned SHA and version comment for the azure/login action from v3.0.2 to v3.1.0. Confirmed the new SHA (a641126d1b8aa4d1fa005f4f92df94a3a4c4c906) matches the v3.1.0 release commit referenced in the PR description, and no other workflow logic, inputs, or permissions were touched.
Extended reasoning...
Overview
The diff touches a single file, .github/workflows/release.yml, changing exactly one line: the pinned commit SHA for the azure/login GitHub Action step, bumping it from the SHA corresponding to v3.0.2 to the SHA corresponding to v3.1.0, with the accompanying version comment updated to match. No workflow inputs, permissions, secrets usage, or job structure were altered.
Security risks
This is a routine Dependabot-authored GitHub Actions dependency bump. The action remains pinned to a full-length commit SHA (good practice, unchanged from before), so there's no risk of a mutable tag being used. The new SHA matches the upstream v3.1.0 release commit per the PR's own changelog links. No secrets, credentials, or permission scopes were modified in this diff.
Level of scrutiny
This warrants minimal scrutiny: it is a mechanical, single-line SHA/version bump for a well-known, actively maintained Microsoft-owned action, opened by Dependabot. The diff is trivially reviewable in isolation and matches the PR's stated intent exactly.
Other factors
The bug hunting system reported no findings, and my own reading of the diff confirms it is exactly what's described — no hidden or unrelated changes. This is the kind of change that doesn't need a human to double check.
|
coverage: 87.352%. remained the same — dependabot/github_actions/azure/login-3.1.0 into main |
2 participants
Bumps azure/login from 3.0.2 to 3.1.0.
Release notes
Sourced from azure/login's releases.
Commits
a641126prepare release v3.1.03c5b5ceAdd max-context-population input to override Azure PowerShell MaxCont… (#642)fcd0340Bump browserslist from 4.21.4 to 4.28.8 (#637)5a8018fBump js-yaml from 3.14.2 to 3.15.2 (#643)a23dddfci: reduce scheduled test frequency and clarify workflow names (#639)4c016e0docs: document immutable release model and correct branch reference (#640)63f3c38Automate release tagging via deploy key + self-pin bump (#638)92a0b67Add the ability to prevent the masking of clientId (#634)5cb857dPin GitHub Actions to full-length commit SHAs (#636)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)