Skip to content

build(deps): bump the github-actions group across 1 directory with 2 updates - #147

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-1caa0c913a
Open

build(deps): bump the github-actions group across 1 directory with 2 updates#147
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-1caa0c913a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 2 updates in the / directory: actions/checkout and taiki-e/install-action.

Updates actions/checkout from 6.0.3 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates taiki-e/install-action from 2.84.0 to 2.85.3

Release notes

Sourced from taiki-e/install-action's releases.

2.85.3

  • Update xh@latest to 0.26.2.

  • Update ubi@latest to 0.10.0.

  • Update mise@latest to 2026.7.14.

  • Update martin@latest to 1.13.0.

  • Update cargo-shear@latest to 1.13.3.

  • Update cargo-binstall@latest to 1.21.1.

2.85.2

  • Update prek@latest to 0.4.11.

  • Update mise@latest to 2026.7.13.

  • Update kingfisher@latest to 1.109.0.

2.85.1

  • Update vacuum@latest to 0.30.0.

  • Update uv@latest to 0.11.32.

  • Update mise@latest to 2026.7.12.

  • Update cyclonedx@latest to 0.33.1.

  • Update cargo-neat@latest to 0.5.2.

2.85.0

  • Support wild (alias: wild-linker). (#1949)

  • Support bpf-linker. (#1950)

  • Support rafn. (#1935, thanks @​DarkWanderer)

  • Update cargo-neat@latest to 0.5.1.

  • Update zizmor@latest to 1.28.0.

  • Update wasmtime@latest to 47.0.2.

  • Update uv@latest to 0.11.31.

  • Update syft@latest to 1.49.0.

2.84.1

  • Update wasmtime@latest to 47.0.1.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.85.5] - 2026-07-30

  • Update uv@latest to 0.12.0.

  • Update syft@latest to 1.50.0.

  • Update sccache@latest to 0.17.0.

  • Update mise@latest to 2026.7.16.

[2.85.4] - 2026-07-29

  • Update uv@latest to 0.11.33.

  • Update mise@latest to 2026.7.15.

  • Update biome@latest to 2.5.6.

[2.85.3] - 2026-07-28

  • Update xh@latest to 0.26.2.

  • Update ubi@latest to 0.10.0.

  • Update mise@latest to 2026.7.14.

  • Update martin@latest to 1.13.0.

  • Update cargo-shear@latest to 1.13.3.

  • Update cargo-binstall@latest to 1.21.1.

[2.85.2] - 2026-07-26

  • Update prek@latest to 0.4.11.

  • Update mise@latest to 2026.7.13.

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Jul 28, 2026
@dependabot
build(deps): bump the github-actions group across 1 directory with 2 …
502e089 
…updates

Bumps the github-actions group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout) and [taiki-e/install-action](https://github.com/taiki-e/install-action).


Updates `actions/checkout` from 6.0.3 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6.0.3...3d3c42e)

Updates `taiki-e/install-action` from 2.84.0 to 2.85.3
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](taiki-e/install-action@a6b2e2d...18b1216)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: taiki-e/install-action
  dependency-version: 2.85.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump the github-actions group with 2 updates build(deps): bump the github-actions group across 1 directory with 2 updates Jul 31, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-1caa0c913a branch from 24a8226 to 502e089 Compare July 31, 2026 08:06
@dependabot
dependabot Bot requested a review from a team as a code owner July 31, 2026 08:06
@rominf

rominf commented Aug 3, 2026

Copy link
Copy Markdown
Collaborator

Automated review pass. Not an approval — leaving the merge decision to a maintainer.

Bump verification

Both SHA pins are correct. Verified against the git-refs API, peeling annotated tags where needed:

Action Version Tag type Resolved commit Pin
actions/checkout v7.0.1 lightweight 3d3c42e5aac5ba805825da76410c181273ba90b1 match
taiki-e/install-action v2.85.3 lightweight 18b1216eba7f8039b0f8d131d5473787f0edce68 match

Sanity-checked the outgoing pins too: checkout v6.0.3 is an annotated tag (9f69817…), which peels to df4cb1c0… — matching the line being replaced. Comparing an annotated tag's object SHA directly would report a false mismatch here.

The one breaking change in the actions/checkout range does not apply to this repo. v7.0.0 blocks checking out fork PRs for pull_request_target and workflow_run. Neither trigger is used anywhere in .github/workflows/. The two sites that pass ref: github.event.pull_request.head.sha sit in plain pull_request jobs with unprivileged tokens — the safe pattern, not the one the guard targets. The action.yml input diff v6.0.3→v7.0.1 adds only allow-unsafe-pr-checkout (default false); no inputs removed or renamed, no defaults changed, and this repo passes only fetch-depth and occasionally ref. Node 24 runtime is already proven on the self-hosted runners, which run v7.0.1 on main today.

taiki-e/install-action 2.84.0→2.85.3 is a no-op here. action.yml is byte-identical between the two tags, and the bundled tool manifests resolve to the same versions before and after: cargo-nextest 0.9.140, cargo-llvm-cov 0.8.7. Every changelog entry in range is an unrelated <tool>@latest bump or new-tool support.

Repo hygiene (actionable, none blocking this PR)

  1. Pin drift from stale-base PRs. build(deps): bump the github-actions group across 1 directory with 7 updates #120 moved all 16 actions/checkout pins to v7.0.1. The Stale xfail hint job did not exist at that point; ci: advisory hint for stale expected-failure markers (EAI-7478) #134 later added it carrying a copy-pasted # v6.0.3 pin (confirmed via git blame). So this PR is cleaning up a pin that regressed into the repo weeks after the group bump, not one that simply lagged. Nothing catches this until the next weekly cycle — and if the action isn't otherwise bumped, never. A lint that fails when two uses: lines for the same action carry different version comments would close the gap.

  2. ci.yml:412 — j178/prek-action is invisible to Dependabot. dependabot.yml documents that the version is read from the trailing # vX.Y.Z comment, but this pin's comment is # prek 0.4.5 checksums, which is not a version. It will never be bumped automatically. The adjacent comment also states the commit is "past the v2.0.4 tag" — that is not accurate: 5337cb91e0fa35a7ff31b9ca345126d8bbbcdf16 is exactly tag v2.0.6. Suggest # v2.0.6 (adds prek 0.4.5 checksums) and a corrected note.

  3. ci.yml:491 — dtolnay/rust-toolchain is branch-versioned. That action versions by mutable branches named after the Rust release, so the 1.96.0 branch tip has moved on from the pinned commit. Pinning the SHA is right, but Dependabot cannot track it — same blind spot as (2), worth being aware of rather than fixing.

  4. No cargo ecosystem in dependabot.yml. The workspace's Cargo manifests get no automated updates, so a RUSTSEC advisory in a transitive crate would go unnoticed. Out of scope here, but it is the larger uncovered surface next to the actions entry this PR exercises.

Caveat

I did not read the full actions/checkout v6→v7 source diff (thousands of lines, including an ESM migration). The assessment rests on the published changelog, the action.yml input diff, and this PR's green CI — including the Stale xfail hint (advisory) job, which is the exact job whose checkout is bumped. A behavior change absent from the changelog and not surfacing in CI would go undetected.

One note for whoever merges: the branch is a commit behind main, and main has since touched an unrelated comment block in ci.yml. No conflict, but review with a three-dot diff (origin/main...HEAD) — a two-dot diff makes that comment change look like a revert.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rominf