Repository navigation
chore(deps): Bump the actions group across 1 directory with 6 updates - #2608
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 35666640dc
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| - name: Install uv | ||
| if: matrix.lane != 'immediate-actions' | ||
| uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2 | ||
| uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3 |
There was a problem hiding this comment.
In the changes job, test_ci_changes.py runs on every CI invocation and test_breg_contracts_pin_postgresql_and_use_the_product_entry_points still asserts that this BReg step contains the old 07a047... SHA (lines 3077–3080). Since this line now contains 68559e..., that test deterministically fails and blocks the rest of CI; update the assertion alongside the action pin.
Useful? React with 👍 / 👎.
| - name: Log in to Docker Hub for the PostgreSQL 18 image | ||
| if: github.event_name != 'pull_request' && (github.event_name != 'workflow_dispatch' || github.ref == 'refs/heads/main') && steps.dockerhub.outputs.configured == 'true' | ||
| uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 | ||
| uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0 |
There was a problem hiding this comment.
When the BReg contracts lane runs, products/breg/scripts/check-contracts.sh executes test_postgres_runner.py, whose PostgreSQL 18 workflow test still requires the old docker/login-action@81c6f... value (lines 515–523). This new 8aa583... pin therefore makes the product contract gate fail whenever BReg paths select that lane; update the expected SHA with this workflow change.
Useful? React with 👍 / 👎.
af83bb1 to
db59008
Compare
Bumps the actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.3.2` | `10.3.3` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.87.31` | `2.90.2` | | [docker/login-action](https://github.com/docker/login-action) | `4.7.0` | `4.8.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.39.1` | `4.39.3` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.39.1` | `4.39.3` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.2` | `4.1.3` | Updates `astral-sh/setup-uv` from 10.3.2 to 10.3.3 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@07a047e...68559e9) Updates `taiki-e/install-action` from 2.87.31 to 2.90.2 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@1e29709...3a3daaf) Updates `docker/login-action` from 4.7.0 to 4.8.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@81c6f93...8aa5831) Updates `github/codeql-action/init` from 4.39.1 to 4.39.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@9b32540...33d7b85) Updates `github/codeql-action/analyze` from 4.39.1 to 4.39.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@9b32540...33d7b85) Updates `sigstore/cosign-installer` from 4.1.2 to 4.1.3 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@6f9f177...756fe2d) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.3.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: docker/login-action dependency-version: 4.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: github/codeql-action/analyze dependency-version: 4.39.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: github/codeql-action/init dependency-version: 4.39.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: sigstore/cosign-installer dependency-version: 4.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: taiki-e/install-action dependency-version: 2.90.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
db59008 to
f1cc596
Compare
Bumps the actions group with 6 updates in the / directory:
10.3.210.3.32.87.312.90.24.7.04.8.04.39.14.39.34.39.14.39.34.1.24.1.3Updates
astral-sh/setup-uvfrom 10.3.2 to 10.3.3Release notes
Sourced from astral-sh/setup-uv's releases.
Commits
68559e9Use Astral mirror for version manifests with GitHub fallback (#1119)0192b69chore: update known checksums for 0.13.6 (#1117)2f29784docs: use JSDoc for compatible release specifier comment (#1113)9c73321fix: allow whitespace in uv requirement specifiers (#1112)80fbe01fix: resolve ~= specifiers with PEP 440 semantics (#1111)36b7b57fix: only report a saved cache when saving succeeded (#1110)56618cadocs: update version references to v10.3.2 (#1104)Updates
taiki-e/install-actionfrom 2.87.31 to 2.90.2Release notes
Sourced from taiki-e/install-action's releases.
... (truncated)
Changelog
Sourced from taiki-e/install-action's changelog.
... (truncated)
Commits
3a3daafRelease 2.90.29002010Update yq manifestb15e87aUpdate vacuum manifest35247b9Updatetrivy@latestto 0.76.2851a180Updatetombi@latestto 1.10.06aa2ee9Update syft manifesteeedd0cUpdate rclone manifesta96a6aaUpdate protoc-gen-connect-openapi manifestca1644aUpdateprek@latestto 0.5.106ba2993Updatemise@latestto 2026.11.2Updates
docker/login-actionfrom 4.7.0 to 4.8.0Release notes
Sourced from docker/login-action's releases.
Commits
8aa5831Merge pull request #1105 from docker/dependabot/npm_and_yarn/docker/actions-t...043f81d[dependabot skip] chore: update generated content3ff6998build(deps): bump@docker/actions-toolkitfrom 0.107.0 to 0.109.0694ef6aMerge pull request #1103 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...7c6e412[dependabot skip] chore: update generated contentaa2441fbuild(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...d6c10b0Merge pull request #1106 from docker/dependabot/github_actions/codeql-actions...319f1eeMerge pull request #1104 from docker/dependabot/github_actions/actions/setup-...b483b7fMerge pull request #1101 from docker/dependabot/npm_and_yarn/vite-7.3.7dc7d67cMerge pull request #1070 from crazy-max/increase-oidc-default-expiryUpdates
github/codeql-action/initfrom 4.39.1 to 4.39.3Release notes
Sourced from github/codeql-action/init's releases.
Changelog
Sourced from github/codeql-action/init's changelog.
... (truncated)
Commits
33d7b85Merge pull request #4299 from github/update-v4.39.3-064910ba224393f8Update changelog for v4.39.3064910bMerge pull request #4297 from github/mbg/update-globf532ac5Updateglobto14.0.38cd4dfaMerge pull request #4280 from github/mbg/ci/validate-yamlcea289bReturn different exit code when a language is not recognised7287bb3Removeexcludeentry that's no longer needed8eb7cdfUse normal.editorconfigpattern160e547Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml913e1bbMerge pull request #4283 from github/sam-robson/decode-diff-informed-sarif-urisUpdates
github/codeql-action/analyzefrom 4.39.1 to 4.39.3Release notes
Sourced from github/codeql-action/analyze's releases.
Changelog
Sourced from github/codeql-action/analyze's changelog.
... (truncated)
Commits
33d7b85Merge pull request #4299 from github/update-v4.39.3-064910ba224393f8Update changelog for v4.39.3064910bMerge pull request #4297 from github/mbg/update-globf532ac5Updateglobto14.0.38cd4dfaMerge pull request #4280 from github/mbg/ci/validate-yamlcea289bReturn different exit code when a language is not recognised7287bb3Removeexcludeentry that's no longer needed8eb7cdfUse normal.editorconfigpattern160e547Merge remote-tracking branch 'origin/main' into mbg/ci/validate-yaml913e1bbMerge pull request #4283 from github/sam-robson/decode-diff-informed-sarif-urisUpdates
sigstore/cosign-installerfrom 4.1.2 to 4.1.3Release notes
Sourced from sigstore/cosign-installer's releases.
Commits
756fe2dBump Cosign to v3.1.4 (latest release) (#257)b9c3539Bump actions/setup-go from 6.4.0 to 7.0.0 (#249)84205a0close race on windows due to reusing filename (#253)af595e6Bump cosign to 3.1.3 (#252)828df1efix: harden curl download retries against transient GitHub CDN 504s (#240)874852dBump actions/checkout from 6.0.2 to 7.0.1 (#250)3094a48wrap path in quotes for powershell (#246)e246ae3test minimum of 1.26 given cosign requirement (#247)