Build(deps): bump docker/login-action from 3.3.0 to 4.3.0 - #341
Merged
github-actions[bot] merged 1 commit intoJul 9, 2026
Merged
Conversation
dependabot
Bot
added
dependencies
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
auto-merge was automatically disabled
July 5, 2026 03:56
Tried to create or update workflow without `workflows` permission
leynos
added a commit
that referenced
this pull request
Jul 9, 2026
* Upload coverage to CodeScene from the coverage job The CodeScene app posts a "Code Coverage" check on every pull request head and waits for a coverage upload for that commit. The coverage job generated and merged `lcov.info` but never uploaded it, so the check timed out on every pull request, driving the status-check rollup to FAILURE and jamming Dependabot automerge (PRs #343 and #341 sat BLOCKED with all required checks green). Switch coverage generation to the shared `leynos/shared-actions` `generate-coverage` action (pinned to the same revision the workflow already uses for `setup-rust`, with `use-cargo-nextest: 'false'` to preserve the existing plain `cargo llvm-cov` runs) and add the shared `upload-codescene-coverage` step, guarded so runs without the `CS_ACCESS_TOKEN` secret skip the upload rather than fail. The now-unused local `generate-coverage` action is removed. `CS_ACCESS_TOKEN` is configured as both an Actions secret and a Dependabot secret so Dependabot-triggered runs can also upload. * Upload coverage from the pull-request head checkout CodeScene records each upload against the commit checked out when the CLI runs, and its pull-request check waits for coverage keyed to the head SHA. The coverage job previously checked out the default `refs/pull/<n>/merge` ref, so uploads were keyed to the synthetic merge commit and the head check could still time out. Check out `github.event.pull_request.head.sha` in the coverage job instead. * Pin the coverage actions to shared-actions 158d04f Pick up leynos/shared-actions#333: `generate-coverage` now preserves per-line records in lcov output, and `upload-codescene-coverage` survives the rewritten CodeScene installer by passing the CLI version as an argument. The `setup-rust` pins are unchanged. * Drive the CodeScene PR gate with cs-coverage check CodeScene accepts `cs-coverage upload` only for analysed branches (main), so the previous upload step could never satisfy the pull-request "Code Coverage" check. Switch the step to the shared action's new `mode: check` (shared-actions#334), which runs `cs-coverage check` against project 68298 to evaluate changed-line coverage. The check diffs the PR against its merge base, so the coverage job now checks out with `fetch-depth: 0` on the default merge ref, matching CodeScene's documented example; the head-SHA checkout from 574325e is superseded. * Upload main-branch coverage and ratchet the sqlite leg Add `coverage-main.yml`, triggered only by pushes to `main`: it regenerates and merges the same coverage as the pull-request job and uploads it with `cs-coverage upload`, which CodeScene accepts solely for analysed branches. This populates the project dashboard and gives analyses coverage for the analysed commit. Enable the coverage ratchet (`with-ratchet`) on the sqlite `generate-coverage` invocation in both workflows. The main run saves the authoritative baseline — caches created on `main` are readable by every pull-request run — while PR runs compare against it and fail if line coverage drops. The ratchet supports one baseline per job, so the sqlite leg (the default feature set and broadest suite) carries it; the postgres leg remains unratcheted. * Run coverage and Makefile tests under nextest Drop the `use-cargo-nextest: 'false'` overrides so the shared `generate-coverage` action runs `cargo llvm-cov nextest` in both the pull-request and main coverage workflows, and adopt the agent-template-rust Makefile convention: a `TEST_CMD` variable that prefers nextest when installed and falls back to `cargo test`. nextest does not execute doctests, so add a `test-doc` target (run under the default sqlite backend) to the `test` aggregate. The suite had never run these doctests before; all five pass. * Pin third-party actions in the main coverage workflow Pin `taiki-e/install-action` and `oven-sh/setup-bun` to commit hashes, resolving the CodeQL unpinned-action findings on the new workflow. The equivalent references in ci.yml predate this branch and are left for a separate pinning pass. --------- Co-authored-by: leynos <leynos@rohga>
Owner
|
@dependabot rebase |
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.3.0 to 4.3.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](docker/login-action@9780b0c...c99871d) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/docker/login-action-4.2.0
branch
from
July 9, 2026 12:27
cce261d to
f4b2084
Compare
There was a problem hiding this comment.
No application code in the PR — skipped Code Health checks.
See analysis details in CodeScene
Quality Gate Profile: Pay Down Tech Debt
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.
github-actions
Bot
deleted the
dependabot/github_actions/docker/login-action-4.2.0
branch
July 9, 2026 12:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps docker/login-action from 3.3.0 to 4.3.0.
Release notes
Sourced from docker/login-action's releases.
... (truncated)
Commits
c99871dMerge pull request #1030 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...b433555[dependabot skip] chore: update generated content678a46abuild(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...f9a0aeaMerge pull request #1031 from docker/dependabot/npm_and_yarn/sigstore-4.1.1cc1e4cbbuild(deps): bump sigstore from 4.1.0 to 4.1.102e1730Merge pull request #1029 from docker/dependabot/npm_and_yarn/sigstore/verify-...b548518build(deps): bump@sigstore/verifyfrom 3.1.0 to 3.1.1a244be3Merge pull request #1027 from docker/dependabot/npm_and_yarn/docker/actions-t...ee0d698[dependabot skip] chore: update generated content127dc2cbuild(deps): bump@docker/actions-toolkitfrom 0.91.0 to 0.92.0