Skip to content

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Nov 18, 2025

Bumps peter-evans/create-pull-request from 3.10.1 to 7.0.8.

Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v7.0.8

What's Changed

Full Changelog: peter-evans/create-pull-request@v7.0.7...v7.0.8

Create Pull Request v7.0.7

⚙️ Fixes an issue with commit signing where modifications to the same file in multiple commits squash into the first commit.

What's Changed

New Contributors

Full Changelog: peter-evans/create-pull-request@v7.0.6...v7.0.7

Create Pull Request v7.0.6

... (truncated)

Commits
  • 271a8d0 fix: suppress output for some git operations (#3776)
  • 6f7efd1 test: update cpr-example-command
  • 13c47c5 build(deps-dev): bump prettier from 3.5.1 to 3.5.2 (#3754)
  • 63e5829 build(deps): bump @​octokit/plugin-paginate-rest from 11.4.2 to 11.4.3 (#3753)
  • a92c90f build(deps-dev): bump eslint-import-resolver-typescript (#3752)
  • b23b62d build(deps-dev): bump ts-jest from 29.2.5 to 29.2.6 (#3751)
  • dd2324f fix: use showFileAtRefBase64 to read per-commit file contents (#3744)
  • 367180c ci: remove testv5 cmd
  • 25575a1 build: update distribution (#3736)
  • a56e7a5 build(deps): bump @​octokit/core from 6.1.3 to 6.1.4 (#3711)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 3.10.1 to 7.0.8.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@v3.10.1...v7.0.8)

---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
  dependency-version: 7.0.8
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Nov 18, 2025

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Nov 18, 2025

Dependabot can't parse your create-release-tag.yml. Because of this, Dependabot cannot update this pull request.

Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR bumps the peter-evans/create-pull-request GitHub Action from v3.10.1 to v7.0.8, a major version upgrade spanning 4 major versions. The update brings security improvements, bug fixes, and modern Node.js support while maintaining compatibility with the parameters currently in use.

Key Changes:

  • Updates the action version to gain security patches and improvements from v4 through v7
  • Inherits new default behavior where release branches are automatically deleted after PR closure/merge

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

include: "**.md"
- name: Create Pull Request
uses: peter-evans/create-pull-request@v3.10.1
uses: peter-evans/create-pull-request@v7.0.8
Copy link

Copilot AI Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The upgrade from v3.10.1 to v7.0.8 includes a breaking change in default behavior: the delete-branch parameter now defaults to true (changed in v4), whereas in v3 it defaulted to false.

This means that after the pull request created by this action is closed or merged, the release branch will be automatically deleted. If you want to preserve the release branches (e.g., release/${{ github.event.inputs.new_operator_version }}), you should explicitly set delete-branch: false in the action configuration.

Example:

- name: Create Pull Request
  uses: peter-evans/create-pull-request@v7.0.8
  with:
    branch: "release/${{ github.event.inputs.new_operator_version }}"
    title: "Splunk AI Operator ${{ github.event.inputs.new_operator_version }} release"
    reviewers: "${{ steps.dotenv.outputs.REVIEWERS }}"
    delete-branch: false  # Add this to preserve the old behavior
    body: |
      ### Automated Pull Request for Splunk AI Operator Release ${{ github.event.inputs.new_operator_version }}
      * Changes added to docs/ChangeLog-NEW.md. Please filter and update ChangeLog.md
      * Delete ChangeLog-New.md

Copilot uses AI. Check for mistakes.
@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Nov 18, 2025

Dependabot couldn't access the repository. Because of this, Dependabot cannot update this pull request.

vivekr-splunk pushed a commit that referenced this pull request Nov 18, 2025
Add comprehensive dependency management tools and documentation to reduce
Dependabot noise and streamline dependency updates.

Changes:

1. **Updated .github/dependabot.yml**
   - Reduced update frequency: weekly → monthly for Go, quarterly for Actions
   - Reduced open PR limit: 10 → 5 for Go, 10 → 3 for Actions
   - Added dependency grouping to batch related updates:
     - kubernetes-core: k8s.io/* packages together
     - kubernetes-sigs: sigs.k8s.io/* packages together
     - cloud-providers: Azure, AWS SDKs together
     - observability: Prometheus, logr together
     - testing: Test frameworks together
   - Ignore major version updates (require manual review)
   - This reduces ~20 individual PRs down to ~5 grouped PRs per month

2. **New: scripts/close-dependabot-issues.sh**
   - Automated script to close irrelevant Dependabot issues
   - Closes GitHub Actions updates (we pin to commit hashes)
   - Closes invalid issues (e.g., Golang 1.24→1.25 when we're on 1.23.0)
   - Adds explanatory comments before closing
   - Handles 12 current issues: #29-41 (Actions), #34 (invalid)

3. **New: .github/ISSUE_TEMPLATE/dependency-updates-tracking.md**
   - Template for creating consolidated dependency update issues
   - Includes checklists for testing and validation
   - Guides through update process step-by-step
   - Reusable for future release cycles

4. **New: docs/post-v0.1.0-dependency-updates.md**
   - Complete tracking issue content for v0.2.0 dependency updates
   - Categorizes 9 remaining Dependabot issues by priority:
     - HIGH: K8s core (#46,#45,#42), controller-runtime (#49), cert-manager (#44)
     - MEDIUM: Azure SDK (#48), observability (#39,#43)
     - LOW: Testing deps (#47,#38)
   - Includes implementation plan, testing checklist, timeline
   - Ready to be posted as GitHub issue after v0.1.0 release

Benefits:
- Reduces Dependabot noise from 20+ weekly PRs to 5 monthly grouped PRs
- Provides clear process for handling dependency updates
- Batches related updates for easier testing
- Documents why certain issues are closed
- Creates structured approach for future updates

Impact:
- 12 irrelevant issues can be closed immediately
- 9 valid issues consolidated into one v0.2.0 tracking issue
- Future Dependabot PRs will be grouped and less frequent

Usage:
1. Run: ./scripts/close-dependabot-issues.sh (after v0.1.0 release)
2. Create tracking issue using docs/post-v0.1.0-dependency-updates.md
3. New Dependabot config takes effect immediately

🤖 Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>
@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Nov 18, 2025

Superseded by #62.

@dependabot dependabot bot closed this Nov 18, 2025
@dependabot dependabot bot deleted the dependabot/github_actions/peter-evans/create-pull-request-7.0.8 branch November 18, 2025 21:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant