-
Notifications
You must be signed in to change notification settings - Fork 309
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
semver release tags #307
Comments
Faced with the same thing. |
Thanks for the feedback. We started creating |
Please do not create anything yet .
How can you confirm the value is correct?
…On Wed, 8 Sep 2021, 2:08 am Aditya Sharad, ***@***.***> wrote:
Closed #307 <#307>.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#307 (comment)>, or
unsubscribe
<https://github.com/notifications/unsubscribe-auth/AUQK4KJM7OSKU77CKWZQO4DUA2LNRANCNFSM4TYXUC6A>
.
|
to let Dependabot keep track of them using SHAs codeql-actions doesn't point to SHAs because it isn't clear whether Dependabot supports their release cycle mentioned at github/codeql-action#307
Would it be possible to start tagging semver-compatible releases?
We follow GitHub's best practice of pinning our Actions to full length commit SHAs.
We use Dependabot version updates to keep our other Actions up to date. This doesn't work with
github/codeql-action
since there are no released tags.I think everything would work if there were semver compatible tags (e.g.
v1.0.0
,v1.1.0
along thev1
branch).The text was updated successfully, but these errors were encountered: