Skip to content

chore(deps): bump the all-actions group across 1 directory with 5 updates #2190

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 1 commit into from
Closed

chore(deps): bump the all-actions group across 1 directory with 5 updates #2190

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions .github/workflows/_ai-pr-review-core.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,30 +80,30 @@ jobs:
- name: 'Checkout PR code (pull_request)'
if: |-
${{ inputs.event_name == 'pull_request' }}
uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v4
uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # ratchet:actions/checkout@v4
with:
fetch-depth: 1 # PR diff and metadata come from the gh API; git history is not needed.

- name: 'Checkout PR code (workflow_dispatch)'
if: |-
${{ inputs.event_name == 'workflow_dispatch' }}
uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v4
uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # ratchet:actions/checkout@v4
with:
fetch-depth: 1
ref: 'refs/pull/${{ inputs.pr_number_dispatch }}/head'

- name: 'Checkout PR code (issue_comment)'
if: |-
${{ inputs.event_name == 'issue_comment' }}
uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v4
uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # ratchet:actions/checkout@v4
with:
fetch-depth: 1
ref: 'refs/pull/${{ inputs.pr_number_issue }}/head'

- name: 'Checkout PR code (pull_request_review & pull_request_review_comment)'
if: |-
${{ inputs.event_name == 'pull_request_review' || inputs.event_name == 'pull_request_review_comment' }}
uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v4
uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # ratchet:actions/checkout@v4
with:
fetch-depth: 1
ref: 'refs/pull/${{ inputs.pr_number_review }}/head'
Expand All @@ -127,7 +127,7 @@ jobs:
id: 'generate_token'
if: |-
${{ inputs.app_id != '' }}
uses: 'actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42' # ratchet:actions/create-github-app-token@v2
uses: 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1' # ratchet:actions/create-github-app-token@v2
with:
app-id: '${{ inputs.app_id }}'
private-key: '${{ secrets.APP_PRIVATE_KEY }}'
Expand Down Expand Up @@ -355,7 +355,7 @@ jobs:
- name: 'Post PR review failure comment'
if: |-
${{ failure() && (steps.gemini_pr_review.outcome == 'failure' || steps.gemini_pr_review.outcome == 'skipped') }}
uses: 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd'
uses: 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3'
with:
github-token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN_SECRET }}'
script: |-
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/ai-cli.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ jobs:
id: 'generate_token'
if: |-
${{ vars.APP_ID }}
uses: 'actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42' # ratchet:actions/create-github-app-token@v2
uses: 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1' # ratchet:actions/create-github-app-token@v2
with:
app-id: '${{ vars.APP_ID }}'
private-key: '${{ secrets.APP_PRIVATE_KEY }}'
Expand Down Expand Up @@ -120,7 +120,7 @@ jobs:
- name: 'Checkout PR branch'
if: |-
${{ steps.get_context.outputs.is_pr == 'true' }}
uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v4
uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # ratchet:actions/checkout@v4
with:
token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
repository: '${{ github.repository }}'
Expand All @@ -130,7 +130,7 @@ jobs:
- name: 'Checkout main branch'
if: |-
${{ steps.get_context.outputs.is_pr == 'false' }}
uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v4
uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # ratchet:actions/checkout@v4
with:
token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
repository: '${{ github.repository }}'
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/ai-issue-automated-triage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,13 +48,13 @@ jobs:

steps:
- name: 'Checkout repository'
uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v4
uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # ratchet:actions/checkout@v4

- name: 'Generate GitHub App Token'
id: 'generate_token'
if: |-
${{ vars.APP_ID }}
uses: 'actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42' # ratchet:actions/create-github-app-token@v2
uses: 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1' # ratchet:actions/create-github-app-token@v2
with:
app-id: '${{ vars.APP_ID }}'
private-key: '${{ secrets.APP_PRIVATE_KEY }}'
Expand Down Expand Up @@ -127,7 +127,7 @@ jobs:
- name: 'Post Issue Triage Failure Comment'
if: |-
${{ failure() && steps.gemini_issue_triage.outcome == 'failure' }}
uses: 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd'
uses: 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3'
with:
github-token: '${{ steps.generate_token.outputs.token || secrets.GITHUB_TOKEN }}'
script: |-
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/ai-issue-scheduled-triage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,13 +30,13 @@ jobs:

steps:
- name: 'Checkout repository'
uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v4
uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # ratchet:actions/checkout@v4

- name: 'Generate GitHub App Token'
id: 'generate_token'
if: |-
${{ vars.APP_ID }}
uses: 'actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42' # ratchet:actions/create-github-app-token@v2
uses: 'actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1' # ratchet:actions/create-github-app-token@v2
with:
app-id: '${{ vars.APP_ID }}'
private-key: '${{ secrets.APP_PRIVATE_KEY }}'
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/dependabot-auto-merge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ jobs:
steps:
- name: Dependabot metadata
id: metadata
uses: dependabot/fetch-metadata@v2
uses: dependabot/fetch-metadata@v3
with:
github-token: "${{ secrets.GITHUB_TOKEN }}"

Expand Down Expand Up @@ -94,7 +94,7 @@ jobs:

- name: Checkout code
if: steps.check.outputs.is_dependabot == 'true'
uses: actions/checkout@v5
uses: actions/checkout@v7

@github-actions github-actions Bot Jul 9, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using actions/checkout@v7 to check out a pull request ref under a workflow_run trigger will fail because v7 blocks pull request checkouts under privileged contexts by default. To fix this, you need to explicitly opt in by setting allow-unsafe-pr-checkout: true.

with:
ref: refs/pull/${{ steps.pr.outputs.number }}/head
fetch-depth: 0
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/docs-links.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: Check links
# Lychee: covers relative filesystem links, anchor links, and
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/python-dependency-policy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # ratchet:actions/checkout@v4
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v4
with:
fetch-depth: 0

Expand All @@ -56,7 +56,7 @@ jobs:
# python-version is set here so that `python3` in the hash-check step
# (which uses stdlib tomllib, available since 3.11) always resolves to
# a known-good interpreter.
uses: astral-sh/setup-uv@445689ea25e0de0a23313031f5fe577c74ae45a1 # ratchet:astral-sh/setup-uv@v6.3.0
uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # ratchet:astral-sh/setup-uv@v7.6.0
with:
python-version: "3.11"

Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/python-format.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,12 +34,12 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout Repository
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
fetch-depth: 0 # Fetch complete history to locate the merge-base cleanly

- name: Install uv
uses: astral-sh/setup-uv@v6
uses: astral-sh/setup-uv@v7
with:
python-version: "3.11"
enable-cache: false
Expand Down Expand Up @@ -92,12 +92,12 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout Repository
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
fetch-depth: 0 # Fetch complete history to locate the merge-base cleanly

- name: Install uv
uses: astral-sh/setup-uv@v6
uses: astral-sh/setup-uv@v7
with:
python-version: "3.11"
enable-cache: false
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/python-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
fetch-depth: 0

Expand Down Expand Up @@ -186,12 +186,12 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: Install uv
# Leave enable-cache at the default (true) — wheel caching between
# runs is worthwhile here (contrast with detect-recipes above).
uses: astral-sh/setup-uv@v6
uses: astral-sh/setup-uv@v7
with:
python-version: "3.11"

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/python-validate-recipe.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,12 +29,12 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
fetch-depth: 0

- name: Install uv
uses: astral-sh/setup-uv@v6
uses: astral-sh/setup-uv@v7
with:
python-version: "3.11"
enable-cache: false
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/tools-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,10 +32,10 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: Install uv
uses: astral-sh/setup-uv@v6
uses: astral-sh/setup-uv@v7
with:
# Test against the minimum supported Python version.
python-version: "3.11"
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/validate-recipe-structure.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,12 +47,12 @@ jobs:

steps:
- name: Checkout repository
uses: actions/checkout@v4
uses: actions/checkout@v7
with:
fetch-depth: 0

- name: Install uv
uses: astral-sh/setup-uv@v6
uses: astral-sh/setup-uv@v7
with:
# Pin explicitly for reproducibility and to match the sibling
# python-validate-recipe.yml step. Structure checks only need
Expand Down
Loading