Repository navigation
chore(deps): bump the actions-minor-patch group across 1 directory with 3 updates - #1013
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
dependabot
Bot
changed the title
984bad7 to
9d944ce
Compare
freshtonic
left a comment
freshtonic
left a comment
There was a problem hiding this comment.
Run Tests (Node 22) and Run Tests (Node 24) fail because of this PR. Dependabot cannot fix this on its own, so a person must push one more commit to this branch.
Blocker
scripts/__tests__/claude-review-workflow.test.mjs:6 pins ACTION_SHA = 'bf38e86e58df9ebf3420326d019f955bb3be64dd' (v1.0.225). The test pins the reviewed Claude action release and authenticates only with OIDC compares the workflow against that constant, so the bump to 756cc22… (v1.0.235) fails it:
Expected: "anthropics/claude-code-action@bf38e86e58df9ebf3420326d019f955bb3be64dd"
Received: "anthropics/claude-code-action@756cc22e19660d20e8cc9496b4f242475a7f7790"
The pin is a review gate, not an accident. Before you change the constant, read the claude-code-action changes from v1.0.225 to v1.0.235. Make sure that this job still gets the agent mode and the job github_token that the workflow comments describe. Then set ACTION_SHA to 756cc22e19660d20e8cc9496b4f242475a7f7790 in the same PR.
Verified
anthropics/claude-code-actiontagv1.0.235resolves to756cc22e19660d20e8cc9496b4f242475a7f7790. The comment on the pin is correct.release-plz/actiontagv0.5resolves tob8d6b54b02889ff2ae2bb82e8b57c3a8fc1683a5. Both release-plz pins are correct.- The CodeQL bump from
v4.38.0tov4.38.2is a patch release.
Not from this PR (no action needed here)
In .github/workflows/codeql.yml, the step Perform CodeQL Analysis uses github/codeql-action/init, not github/codeql-action/analyze. Thus the job runs init two times and does not analyze or upload results. The job shows green, but it does no scan. This problem was on main before this PR. A separate PR must fix it.
No changeset is necessary. This PR changes only CI workflows, and they are not part of a published package.
| - name: Review pull request | ||
| id: claude-review | ||
| uses: anthropics/claude-code-action@bf38e86e58df9ebf3420326d019f955bb3be64dd # v1.0.225 | ||
| uses: anthropics/claude-code-action@756cc22e19660d20e8cc9496b4f242475a7f7790 # v1.0.235 |
There was a problem hiding this comment.
This bump fails scripts/__tests__/claude-review-workflow.test.mjs, because line 6 of that file still pins ACTION_SHA to bf38e86e58df9ebf3420326d019f955bb3be64dd. Read the action changes from v1.0.225 to v1.0.235. Then set ACTION_SHA to 756cc22e19660d20e8cc9496b4f242475a7f7790 in this PR.
9d944ce to
e8acc6d
Compare
freshtonic
left a comment
freshtonic
left a comment
There was a problem hiding this comment.
Re-review of e8acc6dc. This commit is a Dependabot rebase of 9d944cec. The diff is the same: the three workflow pins and no other change.
The blocker from my previous review is not fixed. On this head, scripts/__tests__/claude-review-workflow.test.mjs:6 still sets ACTION_SHA = 'bf38e86e58df9ebf3420326d019f955bb3be64dd' (v1.0.225). .github/workflows/claude-review.yml:100 now uses 756cc22e19660d20e8cc9496b4f242475a7f7790 (v1.0.235). Thus the test pins the reviewed Claude action release and authenticates only with OIDC fails, and Run Tests (Node 22) is red again.
Dependabot cannot fix this. A person must read the claude-code-action changes from v1.0.225 to v1.0.235, and then push a commit to this branch that sets ACTION_SHA to 756cc22e19660d20e8cc9496b4f242475a7f7790. The open inline thread on claude-review.yml has the same request.
My other notes from the previous review do not change. The release-plz and CodeQL pins are correct, and this PR needs no changeset.
e8acc6d to
6960b48
Compare
freshtonic
left a comment
freshtonic
left a comment
There was a problem hiding this comment.
Re-review of 6960b48e. This commit is one more Dependabot rebase. The diff is the same as e8acc6dc: the three workflow pins and no other change.
The blocker is not fixed. On this head, scripts/__tests__/claude-review-workflow.test.mjs:6 still sets ACTION_SHA = 'bf38e86e58df9ebf3420326d019f955bb3be64dd' (v1.0.225), but .github/workflows/claude-review.yml:100 uses 756cc22e19660d20e8cc9496b4f242475a7f7790 (v1.0.235). Run Tests (Node 22) and Run Tests (Node 24) fail again on this head.
A rebase cannot fix this. A person must read the claude-code-action changes from v1.0.225 to v1.0.235, and then push a commit to this branch that sets ACTION_SHA to 756cc22e19660d20e8cc9496b4f242475a7f7790. The open inline thread on claude-review.yml has the same request.
My other notes do not change. The release-plz and CodeQL pins are correct, and this PR needs no changeset.
558dac2 to
260e774
Compare
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
260e774 to
6feea72
Compare
…th 3 updates Bumps the actions-minor-patch group with 3 updates in the / directory: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action), [github/codeql-action](https://github.com/github/codeql-action) and [release-plz/action](https://github.com/release-plz/action). Updates `anthropics/claude-code-action` from 1.0.225 to 1.0.242 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@bf38e86...6c69018) Updates `github/codeql-action` from 4.38.0 to 4.38.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@v4.38.0...v4.38.2) Updates `release-plz/action` from 0.5.137 to 0.5.139 - [Release notes](https://github.com/release-plz/action/releases) - [Commits](release-plz/action@8e61445...b8d6b54) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.235 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: github/codeql-action dependency-version: 4.38.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch - dependency-name: release-plz/action dependency-version: 0.5.139 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
6feea72 to
cf6723a
Compare
1 participant
Bumps the actions-minor-patch group with 3 updates in the / directory: anthropics/claude-code-action, github/codeql-action and release-plz/action.
Updates
anthropics/claude-code-actionfrom 1.0.225 to 1.0.242Release notes
Sourced from anthropics/claude-code-action's releases.
... (truncated)
Commits
6c69018chore: bump Claude Code to 2.1.290 and Agent SDK to 0.3.290cab360fchore: bump Claude Code to 2.1.289 and Agent SDK to 0.3.289ed670b4chore: bump Claude Code to 2.1.288 and Agent SDK to 0.3.28897c5347chore: bump Claude Code to 2.1.287 and Agent SDK to 0.3.28712dd8d7chore: bump Claude Code to 2.1.286 and Agent SDK to 0.3.286a8cb0dbci: security hardening for GitHub Actions workflows that call Claude (#1867)fd1c128chore: bump Claude Code to 2.1.285 and Agent SDK to 0.3.2858ce9314chore: bump Claude Code to 2.1.284 and Agent SDK to 0.3.284756cc22chore: bump Claude Code to 2.1.283 and Agent SDK to 0.3.2839171db3chore: bump Claude Code to 2.1.282 and Agent SDK to 0.3.282Updates
github/codeql-actionfrom 4.38.0 to 4.38.2Release notes
Sourced from github/codeql-action's releases.
Changelog
Sourced from github/codeql-action's changelog.
Commits
2892aa5Merge pull request #4168 from github/update-v4.38.2-a6ef2c96f8ad03a3Trigger workflows98af865Update changelog for v4.38.2a6ef2c9Merge pull request #4156 from github/mario-campos/fix-validate-cmd1ef28a1Merge pull request #4166 from github/dependabot/github_actions/dot-github/wor...26cb08bMerge pull request #4163 from github/mbg/fix-getCommitOid-stubsf035ce3Merge pull request #4165 from github/dependabot/npm_and_yarn/npm-minor-8eaed9...5e4e255Rebuildb13f5f4Bump ruby/setup-rubyc87fe57RebuildUpdates
release-plz/actionfrom 0.5.137 to 0.5.139Release notes
Sourced from release-plz/action's releases.
Commits
b8d6b54Update to 0.3.169 (#540)7e10418chore(deps): update dependency taiki-e/install-action to v2.87.16 (#538)d857f61chore(deps): update dependency taiki-e/install-action to v2.87.15 (#537)9e858f9chore(deps): update dependency taiki-e/install-action to v2.87.14 (#536)d6c5627Update to 0.3.168 (#535)3acb31echore(deps): update dependency taiki-e/install-action to v2.87.13 (#534)f77cdb1chore(deps): lock file maintenance (#532)