chore(ci): bump docker/login-action from 3.7.0 to 4.1.0#39
chore(ci): bump docker/login-action from 3.7.0 to 4.1.0#39dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.7.0 to 4.1.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@c94ce9f...4907a6d) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
lml2468
left a comment
lml2468
left a comment
There was a problem hiding this comment.
[APPROVE — self-review, posting as COMMENT] Clean SHA-pinned bump.
✅ docker/login-action 3.7.0 → 4.1.0: SHA updated in both occurrences in docker-publish.yml (c94ce9f → 4907a6d), version comment updated.
✅ Used in two places (per-arch build job + merge job) — both updated consistently.
✅ actionlint passed.
Ready to merge.
Jerry-Xin
left a comment
Jerry-Xin
left a comment
There was a problem hiding this comment.
Summary: This PR is relevant to Mininglamp-OSS/octo-admin because it updates the Docker publish workflow used by the project, and the pinned action bump is safe in the current workflow context.
🔴 Blocking: None.
💬 Non-blocking: None.
✅ Highlights:
.github/workflows/docker-publish.yml:178and.github/workflows/docker-publish.yml:233keep the action pinned to a full commit SHA while updating the version comment, preserving the repository’s existing supply-chain hardening pattern.- The
v4.1.0runtime change to Node 24 is compatible with the configured GitHub-hosted runners,ubuntu-latestandubuntu-24.04-arm, so I do not see a runner compatibility blocker. - The login inputs and secret handling are unchanged, and the workflow still gates Docker Hub credentials behind the existing
docker-hub-publishenvironment.
lml2468
left a comment
lml2468
left a comment
There was a problem hiding this comment.
[APPROVE — COMMENT due to self-review restriction] Independent cross-review.
Verified:
- SHA pin —
4907a6ddec9925e35a0a9e82d7399ccc52663121matchesdocker/login-actiontagv4.1.0. ✅ - Both occurrences updated — Lines 178 and 233 in
docker-publish.yml(build job + merge job). ✅ - Usage unchanged —
username+passwordinputs are stable across v3→v4. ✅ - CI — All checks green. ✅
No blocking issues. Standard Dependabot action bump, SHA verified.
|
Superseded by #51. |
dependabot
Bot
deleted the
dependabot/github_actions/docker/login-action-4.1.0
branch
2 participants
Bumps docker/login-action from 3.7.0 to 4.1.0.
Release notes
Sourced from docker/login-action's releases.
Commits
4907a6dMerge pull request #930 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...1e233e6chore: update generated content6c24eadbuild(deps): bump the aws-sdk-dependencies group with 2 updatesee034d7Merge pull request #958 from docker/dependabot/npm_and_yarn/lodash-4.18.11527209Merge pull request #937 from docker/dependabot/npm_and_yarn/proxy-agent-depen...d39362abuild(deps): bump lodash from 4.17.23 to 4.18.1a6f092bchore: update generated content60953f0build(deps): bump the proxy-agent-dependencies group with 2 updates62c6885Merge pull request #936 from docker/dependabot/npm_and_yarn/docker/actions-to...102c0e6chore: update generated contentDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)