ci(deps): Bump the actions group across 1 directory with 5 updates - #149
Merged
Merged
Conversation
Bumps the actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [mamba-org/setup-micromamba](https://github.com/mamba-org/setup-micromamba) | `2.0.7` | `3.0.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.1` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.1` | | [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) | `3.0.0` | `4.1.1` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.37.0` | `4.37.1` | Updates `mamba-org/setup-micromamba` from 2.0.7 to 3.0.0 - [Release notes](https://github.com/mamba-org/setup-micromamba/releases) - [Commits](mamba-org/setup-micromamba@add3a49...d7c9bd8) Updates `actions/upload-artifact` from 4.6.2 to 7.0.1 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@ea165f8...043fb46) Updates `actions/download-artifact` from 4.3.0 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@d3f86a1...3e5f45b) Updates `actions/attest-build-provenance` from 3.0.0 to 4.1.1 - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@977bb37...0f67c3f) Updates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@99df26d...7188fc3) --- updated-dependencies: - dependency-name: mamba-org/setup-micromamba dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/attest-build-provenance dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
dependencies
Owner
|
@coderabbitai review This is the Dependabot recreate of #147 (that PR became unmergeable — GitHub's "Update branch" rebase stripped the commit signature and Please note this PR is riskier than its check rollup suggests. Four of the five bumps land in The bumps:
Verification already carried out on the identical diff in #147, for your cross-check:
Empirical evidence: an advisory Most useful thing you can add: anything in the |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '=== PR diff summary ==='
git diff --stat HEAD^ HEAD
echo
echo '=== Changed workflow diff ==='
git diff --unified=80 HEAD^ HEAD -- .github/workflows/packaging.yml .github/workflows/release.yml .github/workflows/scorecard.yml
echo
echo '=== Workflow files ==='
fd -a -t f -e yml -e yaml .github/workflows | sort
echo
echo '=== release.yml structure ==='
if [ -f .github/workflows/release.yml ]; then
nl -ba .github/workflows/release.yml
fi
echo
echo '=== packaging.yml structure ==='
if [ -f .github/workflows/packaging.yml ]; then
nl -ba .github/workflows/packaging.yml
fi
echo
echo '=== scorecard.yml structure ==='
if [ -f .github/workflows/scorecard.yml ]; then
nl -ba .github/workflows/scorecard.yml
fiLength of output: 31438 🏁 Script executed: #!/bin/bash
set -euo pipefail
fetch_raw() {
local repo="$1" sha="$2" path="$3"
echo "=== ${repo}@${sha}:${path} ==="
curl --fail --silent --show-error --location \
"https://raw.githubusercontent.com/${repo}/${sha}/${path}" \
| sed -n '1,260p'
echo
}
# Upload artifact output consumed by SignPath, and v7's retained input contract.
fetch_raw "actions/upload-artifact" "ea165f8d65b6e75b540449e92b4886f43607fa02" "action.yml"
fetch_raw "actions/upload-artifact" "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" "action.yml"
# Download input contract and implementation details relevant to pattern/merge layout.
fetch_raw "actions/download-artifact" "d3f86a106a0bac45b974a628896c90dbdf5c8093" "action.yml"
fetch_raw "actions/download-artifact" "3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" "action.yml"
# The attestation wrapper's v4 inputs and runtime.
fetch_raw "actions/attest-build-provenance" "977bb373ede98d70efdf65b84cb5f73e068dcc2a" "action.yml"
fetch_raw "actions/attest-build-provenance" "0f67c3f4856b2e3261c31976d6725780e5e4c373" "action.yml"
# Verify that the updated pins resolve to the declared repositories and commits.
for spec in \
"mamba-org/setup-micromamba d7c9bd84e824b79d2af72a2d4196c7f4300d3476" \
"actions/upload-artifact 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a" \
"actions/download-artifact 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" \
"actions/attest-build-provenance 0f67c3f4856b2e3261c31976d6725780e5e4c373" \
"github/codeql-action 7188fc363630916deb702c7fdcf4e481b751f97a"
do
set -- $spec
printf '=== %s@%s ===\n' "$1" "$2"
curl --fail --silent --show-error \
"https://api.github.com/repos/$1/commits/$2" \
| jq -r '"commit: " + .sha + "\nmessage: " + (.commit.message | split("\n")[0])'
doneLength of output: 21523
The 4/4 packaging result, combined with the preserved release contracts above, provides appropriate coverage for this dependency-only update. ✅ Action performedReview finished.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughGitHub Actions workflows update pinned action revisions for packaging, release artifact handling, provenance attestation, and scorecard SARIF uploads. Workflow control flow and configuration remain unchanged. ChangesWorkflow action updates
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This was referenced Jul 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 5 updates in the / directory:
2.0.73.0.04.6.27.0.14.3.08.0.13.0.04.1.14.37.04.37.1Updates
mamba-org/setup-micromambafrom 2.0.7 to 3.0.0Release notes
Sourced from mamba-org/setup-micromamba's releases.
Commits
d7c9bd8Pin github actions (#298)11aea49Bump the node group across 1 directory with 14 updates (#294)5f971b0Hash bytes rather than encoded string (#297)4807357Update Node.js version from 20 to 24 (#296)8a0111dBump the actions group across 1 directory with 4 updates (#289)6a5f054Bump the node group across 1 directory with 13 updates (#292)4d84239Bump the actions group with 2 updates (#285)8271e47Bump the node group with 9 updates (#286)Updates
actions/upload-artifactfrom 4.6.2 to 7.0.1Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
043fb46Merge pull request #797 from actions/yacaovsnc/update-dependency634250cInclude changes in typespec/ts-http-runtime 0.3.5e454baaReadme: bump all the example versions to v7 (#796)74fad66Update the readme with direct upload details (#795)bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)47309c9Merge pull request #754 from actions/Link-/add-proxy-integration-tests02a8460Add proxy integration testb7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEUpdates
actions/download-artifactfrom 4.3.0 to 8.0.1Release notes
Sourced from actions/download-artifact's releases.
... (truncated)
Commits
3e5f45bAdd regression tests for CJK characters (#471)e6d03f6Add a regression test for artifact name + content-type mismatches (#472)70fc10cMerge pull request #461 from actions/danwkennedy/digest-mismatch-behaviorf258da9Add change docsccc058eFix linting issuesbd7976bAdd a setting to specify what to do on hash mismatch and default it toerrorac21fcfMerge pull request #460 from actions/danwkennedy/download-no-unzip15999bfAdd note about package bumps974686eBump the version tov8and add release notesfbe48b1Update test names to make it clearer what they doUpdates
actions/attest-build-provenancefrom 3.0.0 to 4.1.1Release notes
Sourced from actions/attest-build-provenance's releases.
... (truncated)
Commits
0f67c3fBump actions/checkout from 6.0.3 to 7.0.0 (#857)21b787dUpdate actions/attest to v4.1.1 (#858)f14352aadd dependabot cooldown (#851)2c04a00Bump actions/checkout from 6.0.2 to 6.0.3 in the actions-minor group (#850)10334b5remove badges from README (#840)c5efebdremove prober workflows (#837)a2bbfa2bump actions/attest from 4.0.0 to 4.1.0 (#838)0856891update RELEASE.md docs (#836)e4d4f7cprepare v4 release (#835)02a49bdBump github/codeql-action in the actions-minor group (#824)Updates
github/codeql-action/upload-sariffrom 4.37.0 to 4.37.1Release notes
Sourced from github/codeql-action/upload-sarif's releases.
Changelog
Sourced from github/codeql-action/upload-sarif's changelog.
... (truncated)
Commits
7188fc3Merge pull request #4020 from github/update-v4.37.1-9e7c07009c8b5f69Update changelog for v4.37.19e7c070Merge pull request #4014 from github/mbg/explicit-remote-prefix3492b7eChangeREMOTE_PATH_PREFIXtoremote=3654baaMerge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix2d682acMerge pull request #4017 from github/dependabot/github_actions/dot-github/wor...23f6a50Merge pull request #4009 from github/mbg/action-state/additions1ee3c75Merge pull request #4018 from github/dependabot/github_actions/dot-github/wor...e053684Merge pull request #4015 from github/dependabot/npm_and_yarn/npm-minor-fd2e83...6803c56Merge pull request #4019 from github/update-bundle/codeql-bundle-v2.26.1Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary by CodeRabbit