deps(actions)(deps): bump the github-actions group with 3 updates - #83
Merged
scttfrdmn merged 2 commits intoAug 3, 2026
Merged
Conversation
Bumps the github-actions group with 3 updates: [actions/checkout](https://github.com/actions/checkout), [actions/setup-java](https://github.com/actions/setup-java) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release). Updates `actions/checkout` from 6.0.3 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@df4cb1c...3d3c42e) Updates `actions/setup-java` from 5.4.0 to 5.6.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@1bcf9fb...03ad4de) Updates `softprops/action-gh-release` from 2.6.2 to 3.0.2 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@3bb1273...3d0d988) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-java dependency-version: 5.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
Dependabot's bump moved actions/checkout to 3d3c42e while writing `# v6` on all five refs. That SHA is v7.0.1. A three-major jump was labelled as a same-line bump, and the label is the only human-readable part of a pin — a wrong one is worse than none, because it makes the diff look routine. Labels corrected to the tags the SHAs actually carry: actions/checkout 3d3c42e # v6 -> # v7.0.1 actions/setup-java 03ad4de # v5 -> # v5.6.0 gradle/actions/setup-gradle 48b5f21 # v4 -> # v4.4.3 (pre-existing on main) SpawnCiHygieneTest passed the mislabelled bump because it only required that SOME `# vN` be present. It now requires an exact vX.Y.Z: a bare major can keep meaning something new as the pin moves, an exact version either matches or is a visible lie. That is the strongest form of the claim checkable offline, so the Spock suite stays hermetic. scripts/verify-pins.sh does the network half — resolve each SHA against the tag its comment claims — and is wired into ci.yml, so it gates PRs and catches the next mislabelled bump before merge, not after. Both checks accept annotated-tag pins. setup-gradle pins v4.4.3's tag OBJECT (48b5f21) rather than the commit (ed40850); GitHub resolves either. An earlier draft compared against one form only and reported a correct pin as mislabelled, printing "comment says v4.4.3 ... SHA is actually v4.4.3". The majors are safe here, checked rather than assumed: - action-gh-release@v3 moves to the Node 24 runtime. orion runs runner 2.336.0 and checkout@v6.0.3 was already `using: node24` and passing, so the runtime is present. - checkout@v7's only behavior change blocks fork checkouts under pull_request_target / workflow_run. Neither trigger appears in this repo. checkout@v7.0.1 was already exercised by this PR on both runners: ci.yml on self-hosted orion and security.yml on ubuntu-latest. Only release.yml is unexercised until the next tag. Verified: ./gradlew test green (96 tests, 5 hygiene features); verify-pins.sh OK on all 12 pins; shellcheck clean. Mutation-tested — bare-major label, wrong label, nonexistent tag and altered SHA each fail, workflows byte-identical after. build.gradle version untouched (0.10.0).
Collaborator
|
Pushed a fix commit — this bump was mislabelled and I'd have merged a three-major jump thinking it was a patch. The defectThe bump moved The label is the only human-readable part of a pin. A wrong one is worse than a missing one, because it makes the diff look boring. Corrected to the tags the SHAs really carry:
That last one is pre-existing on Why the hygiene test didn't catch it
Both accept annotated-tag pins. The majors are safe here — checked, not assumed
Worth noting Verification
|
scttfrdmn
deleted the
dependabot/github_actions/github-actions-087343986b
branch
August 3, 2026 16:40
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the github-actions group with 3 updates: actions/checkout, actions/setup-java and softprops/action-gh-release.
Updates
actions/checkoutfrom 6.0.3 to 7.0.1Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Updates
actions/setup-javafrom 5.4.0 to 5.6.0Release notes
Sourced from actions/setup-java's releases.
Commits
03ad4deBackport #1097/#1098: cache Maven and Gradle wrapper distributions separately...d229d2eBackport #1111: Preserve Maven toolchains across repeated setup-java runs (#1...bbf0f69dist: Cover Tencent Kona JDK 25 (#1110)513edc4feat: expose cache-primary-key output (#597) [v5 backport] (#1089)62df799Add Maven compiler problem matcher for javac diagnostics (#1087)176156achore: bump version to 5.6.0 for v5 release linebf7b8debuild: rebuild dist for backported changes (#1079, #1083, #1084)0173e6dInfer distribution from asdf .tool-versions vendor prefix (#1084)f45cd82Rename jdkFile input to jdk-file with deprecated alias (#1083)e2863adMap Zulu x86 architecture to i686 for Azul Metadata API (#1079)Updates
softprops/action-gh-releasefrom 2.6.2 to 3.0.2Release notes
Sourced from softprops/action-gh-release's releases.
Changelog
Sourced from softprops/action-gh-release's changelog.
... (truncated)
Commits
3d0d988release 3.0.2 (#818)7e13ed4fix: clarify release creation 404 errors (#817)e6c70a5fix: replace existing release assets on Gitea (#816)f345337fix: publish existing draft releases as prereleases (#801)d8a89a2fix: upload small checksum assets reliably (#815)45ece40chore(deps): remove unused TypeScript tooling (#814)f6b913cfeat: improve release error reporting and test coverage (#813)15f193dchore(deps): upgrade TypeScript to 7 (#812)cc8268dchore(deps): bump actions/checkout in the github-actions group (#810)fd0ed1echore(deps): bump the npm group with 3 updates (#811)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions