Skip to content

chore(deps): bump the github-actions group across 1 directory with 9 updates #2636

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump the github-actions group across 1 directory with 9 updates #2636

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:

- name: Run Claude Code
id: claude
uses: anthropics/claude-code-action@2f8ba26a219c06cfb0f468eef8d97055fa814f97 # v1.0.53
uses: anthropics/claude-code-action@51ea8ea73a139f2a74ff649e3092c25a904aed7e # v1.0.123
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
use_commit_signing: true
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/comment-on-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,13 +13,13 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0

- name: Get previous release
id: previous_release
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
const currentTag = '${{ github.event.release.tag_name }}';
Expand Down Expand Up @@ -53,7 +53,7 @@ jobs:

- name: Get merged PRs between releases
id: get_prs
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
const currentTag = '${{ github.event.release.tag_name }}';
Expand Down Expand Up @@ -103,7 +103,7 @@ jobs:
return Array.from(prNumbers);

- name: Comment on PRs
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
const prNumbers = ${{ steps.get_prs.outputs.result }};
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/conformance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,12 +18,12 @@ jobs:
runs-on: ubuntu-latest
continue-on-error: true
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
enable-cache: true
version: 0.9.5
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 24
- run: uv sync --frozen --all-extras --package mcp-everything-server
Expand All @@ -33,12 +33,12 @@ jobs:
runs-on: ubuntu-latest
continue-on-error: true
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
enable-cache: true
version: 0.9.5
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 24
- run: uv sync --frozen --all-extras --package mcp
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/deploy-docs.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,10 +33,10 @@ jobs:
url: ${{ steps.deployment.outputs.page_url }}

steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Install uv
uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
enable-cache: true
version: 0.9.5
Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/publish-pypi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,10 @@ jobs:
runs-on: ubuntu-latest
needs: [checks]
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Install uv
uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
enable-cache: true
version: 0.9.5
Expand All @@ -25,7 +25,7 @@ jobs:
run: uv build

- name: Upload artifacts
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: release-dists
path: dist/
Expand All @@ -44,10 +44,10 @@ jobs:

steps:
- name: Retrieve release distributions
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: release-dists
path: dist/

- name: Publish package distributions to PyPI
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
12 changes: 6 additions & 6 deletions .github/workflows/shared.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,9 @@ jobs:
pre-commit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
enable-cache: true
version: 0.9.5
Expand Down Expand Up @@ -56,10 +56,10 @@ jobs:
os: [ubuntu-latest, windows-latest]

steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Install uv
uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
enable-cache: true
version: 0.9.5
Expand All @@ -82,9 +82,9 @@ jobs:
readme-snippets:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
enable-cache: true
version: 0.9.5
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/weekly-lockfile-update.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
version: 0.9.5

Expand All @@ -29,7 +29,7 @@
echo '```' >> pr_body.md

- name: Create pull request
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v7
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7

Check warning on line 32 in .github/workflows/weekly-lockfile-update.yml

View check run for this annotation

Claude / Claude Code Review

Stale '# v7' comment on create-pull-request pin 

The trailing comment on this line still reads `# v7`, but the SHA `5f6978f` corresponds to peter-evans/create-pull-request **v8.1.1** (per the Dependabot description). This is a pre-existing inaccuracy — the old SHA was already v8.1.0 with the same `# v7` comment — and Dependabot won't auto-correct it because it only rewrites comments that match a full-semver pattern. Since this line is being touched anyway, consider updating the comment to `# v8.1.1` so it tracks correctly on future bumps.
Copy link
Copy Markdown
Contributor

@claude claude Bot May 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 The trailing comment on this line still reads # v7, but the SHA 5f6978f corresponds to peter-evans/create-pull-request v8.1.1 (per the Dependabot description). This is a pre-existing inaccuracy — the old SHA was already v8.1.0 with the same # v7 comment — and Dependabot won't auto-correct it because it only rewrites comments that match a full-semver pattern. Since this line is being touched anyway, consider updating the comment to # v8.1.1 so it tracks correctly on future bumps.

Extended reasoning...

What the bug is. In .github/workflows/weekly-lockfile-update.yml line 32, the action pin was bumped from c0f553fe549906ede9cf27b5156039d195d2ece0 to 5f6978faf089d4d20b00c7766989d076bb2fc7f1, but the trailing version comment still says # v7. According to the Dependabot PR description, this bump is peter-evans/create-pull-request 8.1.0 → 8.1.1, so the SHA actually corresponds to v8.1.1 — a full major version newer than what the comment claims.

Why Dependabot didn't fix it. Dependabot rewrites the trailing version comment when it recognizes the existing comment as the version it is replacing (a full vX.Y.Z string matching the old version). Here the pre-existing comment was # v7, which didn't match the old version v8.1.0, so Dependabot preserved it verbatim — the same way it preserved # release/v1 on the pypa/gh-action-pypi-publish pin in this PR. This means the comment will keep being left as # v7 on every future bump until someone manually corrects it to a proper full-semver comment.

This is pre-existing. The comment was already wrong before this PR: c0f553fe... is v8.1.0, and the line said # v7 then too. This PR did not introduce the staleness; it just carried it forward. It is also worth noting that contrary to first impressions, not every other pin's comment was updated in this PR — pypa/gh-action-pypi-publish retained its # release/v1 comment for the same reason.

Impact. The SHA pin is what actually executes, so there is zero functional impact. But the entire point of putting a human-readable version comment next to an opaque SHA pin is so reviewers can audit at a glance. A reviewer auditing this workflow would be told they're running v7 of create-pull-request when they're actually running v8.1.1 — two major versions off. That defeats the purpose of the comment and could mislead someone reasoning about which features or breaking changes apply.

How to fix. Change the comment to # v8.1.1 (the exact version corresponding to the pinned SHA). Once the comment matches a full-semver string, Dependabot will keep it in sync automatically on future bumps. Note that hand-editing a Dependabot PR is normally avoided since it can interfere with auto-rebase — an alternative is to land this PR as-is and apply the one-character comment fix in a tiny follow-up.

Step-by-step proof:

  1. The diff line 32 changes uses: peter-evans/create-pull-request@c0f553fe... # v7 to uses: peter-evans/create-pull-request@5f6978f... # v7 — only the SHA changed, not the comment.
  2. The Dependabot PR description states: peter-evans/create-pull-request 8.1.0 → 8.1.1, with commit link peter-evans/create-pull-request/commit/5f6978faf089d4d20b00c7766989d076bb2fc7f1 listed under v8.1.1.
  3. Therefore the SHA on line 32 is v8.1.1, but the comment claims v7 — the comment is stale by a full major version.
  4. Compare to actions/checkout lines elsewhere in this PR: # v4.3.1 → # v6.0.2. Those comments were updated because the old comment exactly matched the old version, which Dependabot recognizes and rewrites. # v7 did not match v8.1.0, so it was left alone.

with:
commit-message: "chore: update uv.lock with latest dependencies"
sign-commits: true
Expand Down
Loading