chore(deps): bump the github-actions group across 1 directory with 14 updates - #4706
chore(deps): bump the github-actions group across 1 directory with 14 updates#4706dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| - name: Create GitHub Release | ||
| id: release | ||
| uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1 | ||
| uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| - name: Create release PR | ||
| id: changesets | ||
| uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0 | ||
| uses: changesets/action@22ccf9aa43179fe9e27dc62e575971d28cce197c # v2.0.0 |
There was a problem hiding this comment.
🔴 Release automation will fail after the changeset tool upgrade
The release automation is upgraded across a breaking major version (changesets/action@v2.0.0 at .github/workflows/changesets-pr.yml:47) without renaming any of the settings it passes, so version bumps and package publishing stop working.
Impact: Release PRs are no longer created and npm packages are never published, silently halting releases.
Renamed inputs/outputs and the Changesets CLI v3 requirement in changesets/action v2
changesets/action v2.0.0 renamed the root action inputs: version → version-script, publish → publish-script, commit → commit-message, title → pr-title, and moved all inputs/outputs to kebab-case (createGithubReleases → create-github-releases, publishedPackages → published-packages). It also removed support for supplying a token via the GITHUB_TOKEN environment variable — it must be passed through the github-token input — and it validates that the repo uses Changesets CLI v3, directing v2 users back to changesets/action@v1.
This repo still pins @changesets/cli 2.26.2 (package.json:76), and both call sites keep the v1-style configuration: .github/workflows/changesets-pr.yml:47-53 (version, commit, title, GITHUB_TOKEN env) and .github/workflows/release.yml:115-120 (publish, createGithubReleases, GITHUB_TOKEN env). Downstream steps also read steps.changesets.outputs.publishedPackages (.github/workflows/release.yml:135), which no longer exists, so published_package_version would be empty and the Docker/Helm/release-notes jobs would misbehave even if the action ran.
Either pin back to changesets/action@v1.9.0 or migrate the inputs/outputs and upgrade the Changesets CLI to v3.
Prompt for agents
The github-actions bump moved changesets/action from v1.9.0 to v2.0.0, which is a breaking major release. The two call sites (.github/workflows/changesets-pr.yml "Create release PR" step and .github/workflows/release.yml "Publish" step) still use v1 configuration: version/publish/commit/title inputs, camelCase createGithubReleases, a GITHUB_TOKEN env var instead of the github-token input, and downstream reads of the publishedPackages output. v2 renamed these (version-script, publish-script, commit-message, pr-title, create-github-releases, published-packages), requires github-token as an explicit input, and refuses to run unless the project uses Changesets CLI v3 — this repo pins @changesets/cli 2.26.2. Decide whether to revert this action to v1.9.0 in this dependency bump, or do a separate migration that upgrades the Changesets CLI to v3 and renames all inputs/outputs (including the release.yml steps that consume publishedPackages to derive published_package_version).
Was this helpful? React with 👍 or 👎 to provide feedback.
|
|
||
| - name: Restore Turbo cache | ||
| uses: WarpBuilds/cache@40f3443ae7b70e568d6e2070ea897f3df94d7553 # v1 | ||
| uses: WarpBuilds/cache@dad44e2487e9dc889ad6e6bd198e77bb2d828eee # v2.0.0 |
There was a problem hiding this comment.
🔍 WarpBuilds/cache major bump (v1 -> v2.0.0) not verified for input compatibility
The turbo cache restore step jumps a major version of WarpBuilds/cache. The step still uses the v1-style path/key/restore-keys inputs. WarpBuilds/cache tracks actions/cache, whose v4->v5 line changed some behaviour around cache-hit semantics and failure modes; a major bump here can silently turn cache restore into a no-op (which only costs time) or, worse, fail the step. Worth checking the action's v2 release notes before merge, since the typecheck job is on the required PR gate.
Was this helpful? React with 👍 or 👎 to provide feedback.
@trigger.dev/build
trigger.dev
@trigger.dev/core
@trigger.dev/python
@trigger.dev/react-hooks
@trigger.dev/redis-worker
@trigger.dev/rsc
@trigger.dev/schema-to-json
@trigger.dev/sdk
commit: |
… updates Bumps the github-actions group with 14 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [docker/login-action](https://github.com/docker/login-action) | `4.2.0` | `4.6.0` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `4.1.0` | `4.2.2` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` | | [changesets/action](https://github.com/changesets/action) | `1.9.0` | `2.0.0` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.157` | `1.0.191` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.1` | `4.0.3` | | [WarpBuilds/setup-node](https://github.com/warpbuilds/setup-node) | `6.3.0` | `7.0.0` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.1` | `3.0.2` | | [denoland/setup-deno](https://github.com/denoland/setup-deno) | `2.0.4` | `2.0.5` | | [WarpBuilds/cache](https://github.com/warpbuilds/cache) | `1.4.13` | `2.0.0` | | [mitchellh/vouch/action/check-pr](https://github.com/mitchellh/vouch) | `1.4.2` | `1.5.0` | | [mitchellh/vouch/action/manage-by-issue](https://github.com/mitchellh/vouch) | `1.4.2` | `1.5.0` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.7` | `0.6.2` | Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `docker/login-action` from 4.2.0 to 4.6.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@650006c...dbcb813) Updates `actions/attest-build-provenance` from 4.1.0 to 4.2.2 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@a2bbfa2...4d10147) Updates `actions/setup-node` from 6.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...8207627) Updates `changesets/action` from 1.9.0 to 2.0.0 - [Release notes](https://github.com/changesets/action/releases) - [Changelog](https://github.com/changesets/action/blob/main/CHANGELOG.md) - [Commits](changesets/action@a45c4d5...22ccf9a) Updates `anthropics/claude-code-action` from 1.0.157 to 1.0.191 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@428971d...239e3a7) Updates `dorny/paths-filter` from 4.0.1 to 4.0.3 - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](dorny/paths-filter@fbd0ab8...ceb8a2b) Updates `WarpBuilds/setup-node` from 6.3.0 to 7.0.0 - [Release notes](https://github.com/warpbuilds/setup-node/releases) - [Commits](WarpBuilds/setup-node@bc639b4...2867cf8) Updates `softprops/action-gh-release` from 3.0.1 to 3.0.2 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@718ea10...3d0d988) Updates `denoland/setup-deno` from 2.0.4 to 2.0.5 - [Release notes](https://github.com/denoland/setup-deno/releases) - [Commits](denoland/setup-deno@667a34c...22d081f) Updates `WarpBuilds/cache` from 1.4.13 to 2.0.0 - [Release notes](https://github.com/warpbuilds/cache/releases) - [Changelog](https://github.com/WarpBuilds/cache/blob/main/RELEASES.md) - [Commits](WarpBuilds/cache@40f3443...dad44e2) Updates `mitchellh/vouch/action/check-pr` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/mitchellh/vouch/releases) - [Commits](mitchellh/vouch@c6d80ea...d66fa29) Updates `mitchellh/vouch/action/manage-by-issue` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/mitchellh/vouch/releases) - [Commits](mitchellh/vouch@c6d80ea...d66fa29) Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.2 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@192e21d...3dc1ecc) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: anthropics/claude-code-action dependency-version: 1.0.191 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: changesets/action dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: denoland/setup-deno dependency-version: 2.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: dorny/paths-filter dependency-version: 4.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: mitchellh/vouch/action/check-pr dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: mitchellh/vouch/action/manage-by-issue dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: WarpBuilds/cache dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: WarpBuilds/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.6.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
3386a40 to
6670487
Compare
1 participant
Bumps the github-actions group with 14 updates in the / directory:
7.0.07.0.14.2.04.6.04.1.04.2.26.4.07.0.01.9.02.0.01.0.1571.0.1914.0.14.0.36.3.07.0.03.0.13.0.22.0.42.0.51.4.132.0.01.4.21.5.01.4.21.5.00.5.70.6.2Updates
actions/checkoutfrom 7.0.0 to 7.0.1Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Updates
docker/login-actionfrom 4.2.0 to 4.6.0Release notes
Sourced from docker/login-action's releases.
Commits
dbcb813Merge pull request #1051 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...5bcb015[dependabot skip] chore: update generated contentb30b2f2build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...9087f1eMerge pull request #1057 from docker/dependabot/npm_and_yarn/js-yaml-5.2.20009830[dependabot skip] chore: update generated content2325523build(deps): bump js-yaml from 5.2.1 to 5.2.24ec1d4aMerge pull request #1056 from docker/dependabot/npm_and_yarn/postcss-8.5.225fc99baMerge pull request #1053 from docker/dependabot/github_actions/aws-actions/co...e512bd5Merge pull request #1052 from docker/dependabot/github_actions/codeql-actions...a146c91Merge pull request #1059 from crazy-max/harden-buildx-scope-pathsUpdates
actions/attest-build-provenancefrom 4.1.0 to 4.2.2Release notes
Sourced from actions/attest-build-provenance's releases.
Commits
4d10147Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (#862)e3fe62eBump the actions-minor group with 2 updates (#860)0f67c3fBump actions/checkout from 6.0.3 to 7.0.0 (#857)21b787dUpdate actions/attest to v4.1.1 (#858)f14352aadd dependabot cooldown (#851)2c04a00Bump actions/checkout from 6.0.2 to 6.0.3 in the actions-minor group (#850)10334b5remove badges from README (#840)c5efebdremove prober workflows (#837)Updates
actions/setup-nodefrom 6.4.0 to 7.0.0Release notes
Sourced from actions/setup-node's releases.
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Updates
changesets/actionfrom 1.9.0 to 2.0.0Release notes
Sourced from changesets/action's releases.
... (truncated)
Changelog
Sourced from changesets/action's changelog.
... (truncated)
Commits
22ccf9av2.0.0e52ce9eVersion Packages (#715)78fdc6bExit pre mode (#714)187a104Update deps for stable (#709)d11394aVersion Packages (next) (#712)5fa6767Fix support for prerelease exits using the new.changeset/prelayout (#711)cae6353Use new self-repository syntax for local GitHub actions (#706)c1722b9Version Packages (next) (#698)77be81bFixed a regression making it impossible to sync new versions of versioning pu...cb3f011Use GitHub API for pushes by default and require explicitgithub-tokenwhen...Updates
anthropics/claude-code-actionfrom 1.0.157 to 1.0.191Release notes
Sourced from anthropics/claude-code-action's releases.
... (truncated)
Commits
239e3a7chore: bump Claude Code to 2.1.228 and Agent SDK to 0.3.2285ef2e55chore: bump Claude Code to 2.1.227 and Agent SDK to 0.3.2276b082c4chore: bump Claude Code to 2.1.226 and Agent SDK to 0.3.2267ff6806chore: bump Claude Code to 2.1.225 and Agent SDK to 0.3.225751e003fix(branch): collapse empty path segments in branch_name_template (#1539)b704dd3fix(branch): validate generated branch name under commit signing (#1582)ecf573bfix: expose conclusion output (#1549)7764306fix: stop retrying deterministic ref updates (#1551)5dd098cci: pass allowed tools through claude args (#1552)4c4309afix(cache): disable setup-bun cache to avoid 5-retry HTML-error burn (#1580)Updates
dorny/paths-filterfrom 4.0.1 to 4.0.3Release notes
Sourced from dorny/paths-filter's releases.
Changelog
Sourced from dorny/paths-filter's changelog.
... (truncated)
Commits
ceb8a2bUpdate CHANGELOG.md for v4.0.3 and v3.0.4 (#327)ef09b88Document safe handling of file list outputs in workflows (#326)44adc5bMerge commit from fork4711b7afeat: add 'some-with-excludes' predicate quantifier (#322)93c889ffix: escape multi-line filenames in list-files shell and csv outputb41dfa9docs: add contents permission to PR example (#248)9af6e5afix: scope base-ignored warning to API path (#319)cae9006docs: update outputs in readme to account for the 'every' predicate-quantifie...7b450ffdocs: update changelog for v4.0.2 (#318)