chore(deps): bump the github-actions group across 1 directory with 14 updates - #4706
chore(deps): bump the github-actions group across 1 directory with 14 updates#4706dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| - name: Create GitHub Release | ||
| id: release | ||
| uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1 | ||
| uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| - name: Create release PR | ||
| id: changesets | ||
| uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0 | ||
| uses: changesets/action@22ccf9aa43179fe9e27dc62e575971d28cce197c # v2.0.0 |
There was a problem hiding this comment.
🔴 Release automation will fail after the changeset tool upgrade
The release automation is upgraded across a breaking major version (changesets/action@v2.0.0 at .github/workflows/changesets-pr.yml:47) without renaming any of the settings it passes, so version bumps and package publishing stop working.
Impact: Release PRs are no longer created and npm packages are never published, silently halting releases.
Renamed inputs/outputs and the Changesets CLI v3 requirement in changesets/action v2
changesets/action v2.0.0 renamed the root action inputs: version → version-script, publish → publish-script, commit → commit-message, title → pr-title, and moved all inputs/outputs to kebab-case (createGithubReleases → create-github-releases, publishedPackages → published-packages). It also removed support for supplying a token via the GITHUB_TOKEN environment variable — it must be passed through the github-token input — and it validates that the repo uses Changesets CLI v3, directing v2 users back to changesets/action@v1.
This repo still pins @changesets/cli 2.26.2 (package.json:76), and both call sites keep the v1-style configuration: .github/workflows/changesets-pr.yml:47-53 (version, commit, title, GITHUB_TOKEN env) and .github/workflows/release.yml:115-120 (publish, createGithubReleases, GITHUB_TOKEN env). Downstream steps also read steps.changesets.outputs.publishedPackages (.github/workflows/release.yml:135), which no longer exists, so published_package_version would be empty and the Docker/Helm/release-notes jobs would misbehave even if the action ran.
Either pin back to changesets/action@v1.9.0 or migrate the inputs/outputs and upgrade the Changesets CLI to v3.
Prompt for agents
The github-actions bump moved changesets/action from v1.9.0 to v2.0.0, which is a breaking major release. The two call sites (.github/workflows/changesets-pr.yml "Create release PR" step and .github/workflows/release.yml "Publish" step) still use v1 configuration: version/publish/commit/title inputs, camelCase createGithubReleases, a GITHUB_TOKEN env var instead of the github-token input, and downstream reads of the publishedPackages output. v2 renamed these (version-script, publish-script, commit-message, pr-title, create-github-releases, published-packages), requires github-token as an explicit input, and refuses to run unless the project uses Changesets CLI v3 — this repo pins @changesets/cli 2.26.2. Decide whether to revert this action to v1.9.0 in this dependency bump, or do a separate migration that upgrades the Changesets CLI to v3 and renames all inputs/outputs (including the release.yml steps that consume publishedPackages to derive published_package_version).
Was this helpful? React with 👍 or 👎 to provide feedback.
|
|
||
| - name: Restore Turbo cache | ||
| uses: WarpBuilds/cache@40f3443ae7b70e568d6e2070ea897f3df94d7553 # v1 | ||
| uses: WarpBuilds/cache@dad44e2487e9dc889ad6e6bd198e77bb2d828eee # v2.0.0 |
There was a problem hiding this comment.
🔍 WarpBuilds/cache major bump (v1 -> v2.0.0) not verified for input compatibility
The turbo cache restore step jumps a major version of WarpBuilds/cache. The step still uses the v1-style path/key/restore-keys inputs. WarpBuilds/cache tracks actions/cache, whose v4->v5 line changed some behaviour around cache-hit semantics and failure modes; a major bump here can silently turn cache restore into a no-op (which only costs time) or, worse, fail the step. Worth checking the action's v2 release notes before merge, since the typecheck job is on the required PR gate.
Was this helpful? React with 👍 or 👎 to provide feedback.
@trigger.dev/build
trigger.dev
@trigger.dev/core
@trigger.dev/python
@trigger.dev/react-hooks
@trigger.dev/redis-worker
@trigger.dev/rsc
@trigger.dev/schema-to-json
@trigger.dev/sdk
commit: |
3386a40 to
6670487
Compare
… updates Bumps the github-actions group with 14 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` | | [docker/login-action](https://github.com/docker/login-action) | `4.2.0` | `4.6.0` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `4.1.0` | `4.2.2` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.4.0` | `7.0.0` | | [changesets/action](https://github.com/changesets/action) | `1.9.0` | `2.1.0` | | [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) | `1.0.157` | `1.0.192` | | [WarpBuilds/setup-node](https://github.com/warpbuilds/setup-node) | `6.3.0` | `7.0.0` | | [dorny/paths-filter](https://github.com/dorny/paths-filter) | `4.0.1` | `4.0.3` | | [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `3.0.1` | `3.0.2` | | [denoland/setup-deno](https://github.com/denoland/setup-deno) | `2.0.4` | `2.0.5` | | [WarpBuilds/cache](https://github.com/warpbuilds/cache) | `1.4.13` | `2.0.0` | | [mitchellh/vouch/action/check-pr](https://github.com/mitchellh/vouch) | `1.4.2` | `1.5.0` | | [mitchellh/vouch/action/manage-by-issue](https://github.com/mitchellh/vouch) | `1.4.2` | `1.5.0` | | [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) | `0.5.7` | `0.6.2` | Updates `actions/checkout` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@9c091bb...3d3c42e) Updates `docker/login-action` from 4.2.0 to 4.6.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@650006c...dbcb813) Updates `actions/attest-build-provenance` from 4.1.0 to 4.2.2 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@a2bbfa2...4d10147) Updates `actions/setup-node` from 6.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@48b55a0...8207627) Updates `changesets/action` from 1.9.0 to 2.1.0 - [Release notes](https://github.com/changesets/action/releases) - [Changelog](https://github.com/changesets/action/blob/main/CHANGELOG.md) - [Commits](changesets/action@a45c4d5...198f833) Updates `anthropics/claude-code-action` from 1.0.157 to 1.0.192 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@428971d...e63208c) Updates `WarpBuilds/setup-node` from 6.3.0 to 7.0.0 - [Release notes](https://github.com/warpbuilds/setup-node/releases) - [Commits](WarpBuilds/setup-node@bc639b4...2867cf8) Updates `dorny/paths-filter` from 4.0.1 to 4.0.3 - [Release notes](https://github.com/dorny/paths-filter/releases) - [Changelog](https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md) - [Commits](dorny/paths-filter@fbd0ab8...ceb8a2b) Updates `softprops/action-gh-release` from 3.0.1 to 3.0.2 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@718ea10...3d0d988) Updates `denoland/setup-deno` from 2.0.4 to 2.0.5 - [Release notes](https://github.com/denoland/setup-deno/releases) - [Commits](denoland/setup-deno@667a34c...22d081f) Updates `WarpBuilds/cache` from 1.4.13 to 2.0.0 - [Release notes](https://github.com/warpbuilds/cache/releases) - [Changelog](https://github.com/WarpBuilds/cache/blob/main/RELEASES.md) - [Commits](WarpBuilds/cache@40f3443...dad44e2) Updates `mitchellh/vouch/action/check-pr` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/mitchellh/vouch/releases) - [Commits](mitchellh/vouch@c6d80ea...d66fa29) Updates `mitchellh/vouch/action/manage-by-issue` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/mitchellh/vouch/releases) - [Commits](mitchellh/vouch@c6d80ea...d66fa29) Updates `zizmorcore/zizmor-action` from 0.5.7 to 0.6.2 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](zizmorcore/zizmor-action@192e21d...3dc1ecc) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: anthropics/claude-code-action dependency-version: 1.0.191 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: changesets/action dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: denoland/setup-deno dependency-version: 2.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 4.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: dorny/paths-filter dependency-version: 4.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: mitchellh/vouch/action/check-pr dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: mitchellh/vouch/action/manage-by-issue dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: WarpBuilds/cache dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: WarpBuilds/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.6.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
6670487 to
d94eacd
Compare
1 participant
Bumps the github-actions group with 14 updates in the / directory:
7.0.07.0.14.2.04.6.04.1.04.2.26.4.07.0.01.9.02.1.01.0.1571.0.1926.3.07.0.04.0.14.0.33.0.13.0.22.0.42.0.51.4.132.0.01.4.21.5.01.4.21.5.00.5.70.6.2Updates
actions/checkoutfrom 7.0.0 to 7.0.1Release notes
Sourced from actions/checkout's releases.
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
3d3c42eprep v7.0.1 release (#2531)2880268escape values passed to --unset (#2530)12cd223trim only ascii whitespace for branch (#2521)62661c4skip running unsafe pr check if input is default (#2518)e8d4307Bump the minor-actions-dependencies group with 2 updates (#2499)631c942eslint 9 (#2474)4f1f4aeBump actions/upload-artifact from 4 to 7 (#2476)ba09753Bump actions/checkout from 6 to 7 (#2488)b9e0990Bump docker/login-action from 3.3.0 to 4.2.0 (#2479)e8cb398Bump docker/build-push-action from 6.5.0 to 7.2.0 (#2478)Updates
docker/login-actionfrom 4.2.0 to 4.6.0Release notes
Sourced from docker/login-action's releases.
Commits
dbcb813Merge pull request #1051 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...5bcb015[dependabot skip] chore: update generated contentb30b2f2build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...9087f1eMerge pull request #1057 from docker/dependabot/npm_and_yarn/js-yaml-5.2.20009830[dependabot skip] chore: update generated content2325523build(deps): bump js-yaml from 5.2.1 to 5.2.24ec1d4aMerge pull request #1056 from docker/dependabot/npm_and_yarn/postcss-8.5.225fc99baMerge pull request #1053 from docker/dependabot/github_actions/aws-actions/co...e512bd5Merge pull request #1052 from docker/dependabot/github_actions/codeql-actions...a146c91Merge pull request #1059 from crazy-max/harden-buildx-scope-pathsUpdates
actions/attest-build-provenancefrom 4.1.0 to 4.2.2Release notes
Sourced from actions/attest-build-provenance's releases.
Commits
4d10147Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (#862)e3fe62eBump the actions-minor group with 2 updates (#860)0f67c3fBump actions/checkout from 6.0.3 to 7.0.0 (#857)21b787dUpdate actions/attest to v4.1.1 (#858)f14352aadd dependabot cooldown (#851)2c04a00Bump actions/checkout from 6.0.2 to 6.0.3 in the actions-minor group (#850)10334b5remove badges from README (#840)c5efebdremove prober workflows (#837)Updates
actions/setup-nodefrom 6.4.0 to 7.0.0Release notes
Sourced from actions/setup-node's releases.
Commits
8207627Migrate to ESM and upgrade dependencies (#1574)04be95cAdd cache-primary-key and cache-matched-key as outputs (#1577)7c2c68ddocs: Update caching recommendations to mitigate cache poisoning risks (#1567)6a61c03Merge pull request #1569 from jasongin/update-actions-cache-5.1.030eb73bResolve high-severity audit issues4e1a87aUpdate dist360237fStrict equality4f8aac5Bump@actions/cacheto 5.1.0, log cache write deniedf4a67bbOnly usemirrorTokeningetManifestif it's provided (#1548)0355742Remove dummy NODE_AUTH_TOKEN export (#1558)Updates
changesets/actionfrom 1.9.0 to 2.1.0Release notes
Sourced from changesets/action's releases.
... (truncated)
Changelog
Sourced from changesets/action's changelog.
... (truncated)
Commits
198f833v2.1.07545547Version Packages (#719)3043070Prevent test warning annotations (#720)3b7c71cAdd back cwd input (#718)6f58ba3Update pr-status message links to new faq (#716)e52ce9eVersion Packages (#715)78fdc6bExit pre mode (#714)187a104Update deps for stable (#709)d11394aVersion Packages (next) (#712)5fa6767Fix support for prerelease exits using the new.changeset/prelayout (#711)Updates
anthropics/claude-code-actionfrom 1.0.157 to 1.0.192Release notes
Sourced from anthropics/claude-code-action's releases.
... (truncated)
Commits
e63208cchore: bump Claude Code to 2.1.232 and Agent SDK to 0.3.232dc33e8achore: bump Claude Code to 2.1.231 and Agent SDK to 0.3.231c58ad32chore: bump Claude Code to 2.1.229 and Agent SDK to 0.3.229dfb8fc7fix(mcp): detect binary files by content instead of extension allowlist (#1633)a2489effix(summary): keep every text block in structured tool results (#1619)8b87458fix: paginate GitHub Actions MCP responses (#1629)239e3a7chore: bump Claude Code to 2.1.228 and Agent SDK to 0.3.2285ef2e55chore: bump Claude Code to 2.1.227 and Agent SDK to 0.3.2276b082c4chore: bump Claude Code to 2.1.226 and Agent SDK to 0.3.2267ff6806chore: bump Claude Code to 2.1.225 and Agent SDK to 0.3.225Updates
WarpBuilds/setup-nodefrom 6.3.0 to 7.0.0Release notes
Sourced from WarpBuilds/setup-node's releases.
Commits
2867cf8Merge pull request #8 from WarpBuilds/sync/upstream-v79aed42eMove to@warpbuilds/cache2.0.092cca72Address zizmor findings in the warp e2e workflowca70432Regenerate license manifests for 2.0.0-113f681fMove to@warpbuilds/cache2.0.0-1b5b858aMove macOS CI to warp-macos-15 runners169d5c0Regenerate license manifests for the new dependency treeb77752bSync upstream v7 and move to@warpbuilds/cache2.xe51e5fefix: update brace-expansion to patch GHSA-3jxr-9vmj-r5cp (exponential-time Do...32f57acdocs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change (#1593)Updates
dorny/paths-filterfrom 4.0.1 to 4.0.3Release notes
Sourced from dorny/paths-filter's releases.
Changelog
Sourced from dorny/paths-filter's changelog.