deps(actions): bump the actions group across 1 directory with 7 updates#275
Closed
dependabot[bot] wants to merge 1 commit intomainfrom
Closed
deps(actions): bump the actions group across 1 directory with 7 updates#275dependabot[bot] wants to merge 1 commit intomainfrom
dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps the actions group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github/codeql-action](https://github.com/github/codeql-action) | `4.33.0` | `4.35.1` | | [gradle/actions](https://github.com/gradle/actions) | `5.0.2` | `6.1.0` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `6.0.0` | `8.0.0` | | [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.13.0` | `1.14.0` | | [ruby/setup-ruby](https://github.com/ruby/setup-ruby) | `1.293.0` | `1.300.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.0` | `7.0.1` | | [rhysd/actionlint](https://github.com/rhysd/actionlint) | `1.7.11` | `1.7.12` | Updates `github/codeql-action` from 4.33.0 to 4.35.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@b1bff81...c10b806) Updates `gradle/actions` from 5.0.2 to 6.1.0 - [Release notes](https://github.com/gradle/actions/releases) - [Commits](gradle/actions@0723195...50e97c2) Updates `astral-sh/setup-uv` from 6.0.0 to 8.0.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@c7f87aa...cec2083) Updates `pypa/gh-action-pypi-publish` from 1.13.0 to 1.14.0 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@ed0c539...cef2210) Updates `ruby/setup-ruby` from 1.293.0 to 1.300.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@dffb23f...e65c17d) Updates `actions/upload-artifact` from 7.0.0 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@bbbca2d...043fb46) Updates `rhysd/actionlint` from 1.7.11 to 1.7.12 - [Release notes](https://github.com/rhysd/actionlint/releases) - [Changelog](https://github.com/rhysd/actionlint/blob/main/CHANGELOG.md) - [Commits](rhysd/actionlint@393031a...914e7df) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: gradle/actions dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: astral-sh/setup-uv dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: ruby/setup-ruby dependency-version: 1.300.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: rhysd/actionlint dependency-version: 1.7.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
github-actions
Bot
added
enhancement
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
4 issues found across 7 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/release-kotlin.yml">
<violation number="1" location=".github/workflows/release-kotlin.yml:41">
P3: The inline version comment is stale after updating the pinned Gradle action commit; update it to match the new action version.</violation>
</file>
<file name=".github/workflows/release-python.yml">
<violation number="1" location=".github/workflows/release-python.yml:35">
P3: Update the stale inline `setup-uv` version comment (`# v6.0.0`) to match the new pinned release so workflow annotations remain accurate.</violation>
</file>
<file name=".github/workflows/release-ruby.yml">
<violation number="1" location=".github/workflows/release-ruby.yml:35">
P3: The inline version comment is stale (`# v1.293.0`) after updating the pinned `ruby/setup-ruby` SHA; update it to the new version to keep the workflow annotation accurate.</violation>
<violation number="2" location=".github/workflows/release-ruby.yml:71">
P3: This second `ruby/setup-ruby` entry also keeps the old `# v1.293.0` annotation; update it to match the bumped action version.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
|
|
||
| - name: Setup Gradle | ||
| uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation | ||
| uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v5.0.2 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation |
There was a problem hiding this comment.
P3: The inline version comment is stale after updating the pinned Gradle action commit; update it to match the new action version.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/release-kotlin.yml, line 41:
<comment>The inline version comment is stale after updating the pinned Gradle action commit; update it to match the new action version.</comment>
<file context>
@@ -38,7 +38,7 @@ jobs:
- name: Setup Gradle
- uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation
+ uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v5.0.2 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation
- name: Build
</file context>
Suggested change
| uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v5.0.2 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation | |
| uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation |
|
|
||
| - name: Install uv | ||
| uses: astral-sh/setup-uv@c7f87aa956e4c323abf06d5dec078e358f6b4d04 # v6.0.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation | ||
| uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v6.0.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation |
There was a problem hiding this comment.
P3: Update the stale inline setup-uv version comment (# v6.0.0) to match the new pinned release so workflow annotations remain accurate.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/release-python.yml, line 35:
<comment>Update the stale inline `setup-uv` version comment (`# v6.0.0`) to match the new pinned release so workflow annotations remain accurate.</comment>
<file context>
@@ -32,7 +32,7 @@ jobs:
- name: Install uv
- uses: astral-sh/setup-uv@c7f87aa956e4c323abf06d5dec078e358f6b4d04 # v6.0.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation
+ uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v6.0.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation
- name: Set up Python
</file context>
|
|
||
| - name: Set up Ruby | ||
| uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache | ||
| uses: ruby/setup-ruby@e65c17d16e57e481586a6a5a0282698790062f92 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache |
There was a problem hiding this comment.
P3: This second ruby/setup-ruby entry also keeps the old # v1.293.0 annotation; update it to match the bumped action version.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/release-ruby.yml, line 71:
<comment>This second `ruby/setup-ruby` entry also keeps the old `# v1.293.0` annotation; update it to match the bumped action version.</comment>
<file context>
@@ -68,7 +68,7 @@ jobs:
- name: Set up Ruby
- uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache
+ uses: ruby/setup-ruby@e65c17d16e57e481586a6a5a0282698790062f92 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache
with:
ruby-version: '3.3'
</file context>
Suggested change
| uses: ruby/setup-ruby@e65c17d16e57e481586a6a5a0282698790062f92 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache | |
| uses: ruby/setup-ruby@e65c17d16e57e481586a6a5a0282698790062f92 # v1.300.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache |
|
|
||
| - name: Set up Ruby | ||
| uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation | ||
| uses: ruby/setup-ruby@e65c17d16e57e481586a6a5a0282698790062f92 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation |
There was a problem hiding this comment.
P3: The inline version comment is stale (# v1.293.0) after updating the pinned ruby/setup-ruby SHA; update it to the new version to keep the workflow annotation accurate.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/release-ruby.yml, line 35:
<comment>The inline version comment is stale (`# v1.293.0`) after updating the pinned `ruby/setup-ruby` SHA; update it to the new version to keep the workflow annotation accurate.</comment>
<file context>
@@ -32,7 +32,7 @@ jobs:
- name: Set up Ruby
- uses: ruby/setup-ruby@dffb23f65a78bba8db45d387d5ea1bbd6be3ef18 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation
+ uses: ruby/setup-ruby@e65c17d16e57e481586a6a5a0282698790062f92 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation
with:
ruby-version: '3.3'
</file context>
Suggested change
| uses: ruby/setup-ruby@e65c17d16e57e481586a6a5a0282698790062f92 # v1.293.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation | |
| uses: ruby/setup-ruby@e65c17d16e57e481586a6a5a0282698790062f92 # v1.300.0 # zizmor: ignore[cache-poisoning] -- cached deps are for testing, not release artifact generation |
Contributor
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 7 updates in the / directory:
4.33.04.35.15.0.26.1.06.0.08.0.01.13.01.14.01.293.01.300.07.0.07.0.11.7.111.7.12Updates
github/codeql-actionfrom 4.33.0 to 4.35.1Release notes
Sourced from github/codeql-action's releases.
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
c10b806Merge pull request #3782 from github/update-v4.35.1-d6d1743b8c5ffd06Update changelog for v4.35.1d6d1743Merge pull request #3781 from github/henrymercer/update-git-minimum-version65d2efaAdd changelog note2437b20Update minimum git version for overlay to 2.36.0ea5f719Merge pull request #3775 from github/dependabot/npm_and_yarn/node-forge-1.4.045ceeeaMerge pull request #3777 from github/mergeback/v4.35.0-to-main-b8bb9f2824448c9Rebuild7c51060Update changelog and version after v4.35.0b8bb9f2Merge pull request #3776 from github/update-v4.35.0-0078ad667Updates
gradle/actionsfrom 5.0.2 to 6.1.0Release notes
Sourced from gradle/actions's releases.
... (truncated)
Commits
50e97c2Link to docs for caching providersf2e6298Restructure caching documentation for basic and enhanced providers (#934)b294b1eReally fix integ-test-full83d3189Revise license details for gradle-actions-caching1d5db06Update license link for gradle-actions-caching component1c80961Fix license link for Enhanced Caching component9e99920Fix integ-test-full workflowbb8aaafFix workflow permissionsf5dfb43[bot] Update dist directoryff9ae24Add open-source 'basic' cache provider and revamp licensing documentation (#930)Updates
astral-sh/setup-uvfrom 6.0.0 to 8.0.0Release notes
Sourced from astral-sh/setup-uv's releases.
... (truncated)
Commits
cec2083Shortcircuit latest version from manifest (#828)4dd8ab4Simplify inputs.ts (#827)7fdbe7cRemove update-major-minor-tags workflow (#826)485abd0Bump release-drafter to v7.1.1 (#825)f82eb19Refactor inputs (#823)868d1f7Replace inline compile args with tsconfig (#824)447e6d0chore: update known checksums for 0.11.2 (#821)5c62c59chore: update known checksums for 0.11.1 (#817)e1a7373chore: update known checksums for 0.11.0 (#815)8970931Remove deprecrated custom manifest (#813)Updates
pypa/gh-action-pypi-publishfrom 1.13.0 to 1.14.0Release notes
Sourced from pypa/gh-action-pypi-publish's releases.
Commits
cef2210Merge pull request #397 from whitequark/patch-1b4595e2Enableverboseandprint-hashby default.e2bab26Merge pull request #395 from him2him2/docs/fix-typos-and-grammar7495c38docs: fix typos and grammar in README and SECURITY03f86feMerge pull request #388 from woodruffw-forks/ww/rm-experimental4c78f1cMerge branch 'unstable/v1' into ww/rm-experimentalb5a6e8bdeps: bump sigstore and pypi-attestationsa48a03eremove another experimental mention8087a88action: remove a lingering mention of PEP 740 being experimental3317ede🧪 Integrate actionlint via pre-commit frameworkUpdates
ruby/setup-rubyfrom 1.293.0 to 1.300.0Release notes
Sourced from ruby/setup-ruby's releases.
Commits
e65c17dAdd jruby-10.0.5.0ba696adRefactor matrix script2327de0TruffleRuby 34+ does not support macOS Intel3ff19f5Update CRuby releases on Windows4dc28cfAdd ruby-3.2.11c515ec1Update CRuby releases on Windowseab2afbAdd ruby-3.3.1197b3338Mention all maintainers in check-new-windows-versions for consistency319994fUpdate CRuby releases on Windowsc984c1aAdd ruby-4.0.2Updates
actions/upload-artifactfrom 7.0.0 to 7.0.1Release notes
Sourced from actions/upload-artifact's releases.
Commits
043fb46Merge pull request #797 from actions/yacaovsnc/update-dependency634250cInclude changes in typespec/ts-http-runtime 0.3.5e454baaReadme: bump all the example versions to v7 (#796)74fad66Update the readme with direct upload details (#795)Updates
rhysd/actionlintfrom 1.7.11 to 1.7.12Release notes
Sourced from rhysd/actionlint's releases.
Changelog
Sourced from rhysd/actionlint's changelog.
... (truncated)
Commits
914e7dfbump up version to v1.7.12f1fe8a1update popular actions data set to the latest0ef3e18add support for https://github.blog/changelog/2026-03-19-github-actions-late-...d2f9e65update document to describe the timezone check inon.schedulec03b271Merge branch 'followup-issue641' (#641)c9efd91fix staticcheck checks files inside./playground/node_modules08e2336include timezone database in executable staticallyf48c0a4fix timezone check is incomplete6b811d3fix problem matcher test fails due to line ending in test data4897c1dMerge pull request #641 from martincostello/gh-638Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary by cubic
Update CI workflows by bumping seven GitHub Actions for better security, reliability, and tooling. This includes newer CodeQL, Gradle v6, immutable
setup-uvv8, and minor fixes to publishing and artifacts.Dependencies
github/codeql-action4.33.0 → 4.35.1gradle/actions5.0.2 → 6.1.0astral-sh/setup-uv6.0.0 → 8.0.0pypa/gh-action-pypi-publish1.13.0 → 1.14.0ruby/setup-ruby1.293.0 → 1.300.0actions/upload-artifact7.0.0 → 7.0.1rhysd/actionlint1.7.11 → 1.7.12Migration
gradle/actions@v6: If you require fully OSS caching, setcache-provider: basic; enhanced caching now has Terms of Use.setup-uv@v8: Major/minor tags are removed; we pin by commit SHA. If you use a custommanifest-file, update it to the new format.Written for commit d26dead. Summary will update on new commits.