From 8159e8ad0d97b4320c27b466d22b2cf84dbaedca Mon Sep 17 00:00:00 2001 From: Patrick Carney Date: Mon, 17 Aug 2026 12:54:14 -0400 Subject: [PATCH] Bump actions to current majors; add Dependabot Silences the runners' Node 20 deprecation warnings (checkout v7, setup-node v7, setup-python v7, upload-artifact v7, download-artifact v8, cache v6, setup-uv v10) and adds weekly Dependabot for the github-actions ecosystem so future pin bumps arrive as PRs. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01U99AjT4THeqirpRGFRygTM --- .github/dependabot.yaml | 6 ++++++ .github/workflows/build-skill.yml | 6 +++--- .github/workflows/conformance.yml | 14 +++++++------- .github/workflows/release-claude-code.yml | 4 ++-- .github/workflows/release-goose.yml | 6 +++--- .github/workflows/release-pypi.yml | 8 ++++---- .github/workflows/sync-prices.yml | 4 ++-- 7 files changed, 27 insertions(+), 21 deletions(-) create mode 100644 .github/dependabot.yaml diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml new file mode 100644 index 0000000..ca79ca5 --- /dev/null +++ b/.github/dependabot.yaml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly diff --git a/.github/workflows/build-skill.yml b/.github/workflows/build-skill.yml index 1136c13..a1d1a1c 100644 --- a/.github/workflows/build-skill.yml +++ b/.github/workflows/build-skill.yml @@ -32,9 +32,9 @@ jobs: timeout-minutes: 5 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: "3.11" cache: pip @@ -64,7 +64,7 @@ jobs: " - name: Upload avp.skill as workflow artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: avp-skill path: dist/avp.skill diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index 05c5a18..63b78e3 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -17,8 +17,8 @@ jobs: timeout-minutes: 5 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-python@v5 + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 with: python-version: "3.11" cache: pip @@ -36,14 +36,14 @@ jobs: needs: lint steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 # The repo is a uv workspace rooted at the repo root; `uv sync` installs # every Python member editable and resolves the cross-package deps (`avp`, # `avp-conformance`, ...) to the in-tree sources rather than PyPI. (There's # an unrelated `avp` package on PyPI; the workspace sources override it.) - name: Install uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@v10 with: python-version: "3.11" enable-cache: true @@ -78,17 +78,17 @@ jobs: if: github.event_name == 'workflow_dispatch' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@v10 with: python-version: "3.11" enable-cache: true # The avp-claude-agent-sdk real_llm tests drive the Claude Agent SDK, which # shells out to the `claude` CLI; install it so it's on PATH. - - uses: actions/setup-node@v4 + - uses: actions/setup-node@v7 with: node-version: "20" - name: Install the claude CLI diff --git a/.github/workflows/release-claude-code.yml b/.github/workflows/release-claude-code.yml index e29059b..dc02d56 100644 --- a/.github/workflows/release-claude-code.yml +++ b/.github/workflows/release-claude-code.yml @@ -28,10 +28,10 @@ jobs: timeout-minutes: 15 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@v10 with: python-version: "3.11" diff --git a/.github/workflows/release-goose.yml b/.github/workflows/release-goose.yml index e8e1bff..88c0b84 100644 --- a/.github/workflows/release-goose.yml +++ b/.github/workflows/release-goose.yml @@ -40,7 +40,7 @@ jobs: - { target: aarch64-unknown-linux-gnu, runner: ubuntu-24.04-arm } steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: System build deps (Linux) if: runner.os == 'Linux' @@ -80,7 +80,7 @@ jobs: tar -czf "$asset" -C target/release avp-goose-conformance shasum -a 256 "$asset" > "$asset.sha256" - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: goose-${{ matrix.target }} path: agents/avp-goose/rust/avp-goose-conformance*-${{ matrix.target }}.tar.gz* @@ -92,7 +92,7 @@ jobs: needs: build timeout-minutes: 10 steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v8 with: path: dist merge-multiple: true diff --git a/.github/workflows/release-pypi.yml b/.github/workflows/release-pypi.yml index bd14767..d60eb1e 100644 --- a/.github/workflows/release-pypi.yml +++ b/.github/workflows/release-pypi.yml @@ -34,14 +34,14 @@ jobs: name: Build avp-cli wheel runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install uv - uses: astral-sh/setup-uv@v5 + uses: astral-sh/setup-uv@v10 with: python-version: "3.11" - name: Build wheel run: uv build --wheel --package avp-cli --out-dir dist - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: dist path: dist/ @@ -54,7 +54,7 @@ jobs: permissions: id-token: write # OIDC token for Trusted Publishing steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v8 with: name: dist path: dist/ diff --git a/.github/workflows/sync-prices.yml b/.github/workflows/sync-prices.yml index 8d86fde..27bed91 100644 --- a/.github/workflows/sync-prices.yml +++ b/.github/workflows/sync-prices.yml @@ -22,9 +22,9 @@ jobs: timeout-minutes: 10 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-python@v5 + - uses: actions/setup-python@v7 with: python-version: "3.11"