Skip to content

chore(deps): bump the github-actions group across 1 directory with 4 updates #1643

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump the github-actions group across 1 directory with 4 updates #1643

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
with:
persist-credentials: false
- name: Install uv and set Python version
uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
version: "0.11.2"
python-version: "3.13"
Expand All @@ -41,12 +41,12 @@
with:
persist-credentials: false
- name: Install uv and set Python version
uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
version: "0.11.2"
python-version: "3.13"
enable-cache: true # zizmor: ignore[cache-poisoning] CI-only, no artifacts published
- uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 # zizmor: ignore[cache-poisoning]
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.4 # zizmor: ignore[cache-poisoning]

Check warning on line 49 in .github/workflows/ci.yml

View check run for this annotation

Claude / Claude Code Review

Stale version comment for actions/cache bump 

On line 49 of `.github/workflows/ci.yml`, the `actions/cache` SHA was bumped to `27d5ce7f107fe9357f9df03efb73ab90386fccae` (which is v5.0.5), but the trailing version comment still reads `# v5.0.4`. Dependabot normally rewrites these comments — this one was missed, so the SHA→version mapping that humans read to audit pinned actions is misleading. Comment-only nit, no runtime impact; please update the comment to `# v5.0.5` to match the rest of the diff.
Copy link
Copy Markdown

@claude claude Bot Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 On line 49 of .github/workflows/ci.yml, the actions/cache SHA was bumped to 27d5ce7f107fe9357f9df03efb73ab90386fccae (which is v5.0.5), but the trailing version comment still reads # v5.0.4. Dependabot normally rewrites these comments — this one was missed, so the SHA→version mapping that humans read to audit pinned actions is misleading. Comment-only nit, no runtime impact; please update the comment to # v5.0.5 to match the rest of the diff.

Extended reasoning...

What the bug is. In .github/workflows/ci.yml line 49, the actions/cache step is updated from SHA 668228422ae6a00e4ad889ee87cd7109ec5666a7 to 27d5ce7f107fe9357f9df03efb73ab90386fccae, but the trailing comment is left unchanged at # v5.0.4. The PR description's actions/cache section explicitly bumps that action from v5.0.4 → v5.0.5, and the actions/cache release notes show 27d5ce7f107fe9357f9df03efb73ab90386fccae as the v5.0.5 release commit ("Merge pull request #1747 from actions/yacaovsnc/update-dependency — Update ts-http-runtime dependency"). So the SHA on line 49 is v5.0.5 but the inline annotation still says v5.0.4.\n\nWhy this is a real (if cosmetic) issue. This repo pins every GitHub Action to an immutable SHA with a trailing # vX.Y.Z comment so reviewers can audit pinned versions at a glance — that is the only reason the comments exist. When Dependabot bumps actions, it rewrites those comments together with the SHA. In this same PR every other action comment was updated correctly: astral-sh/setup-uv v8.0.0 → v8.1.0, github/codeql-action v4.35.1 → v4.35.2, and dependabot/fetch-metadata v3.0.0 → v3.1.0 all have matching SHA + comment changes. Line 49 is the lone outlier where the SHA moved but the comment did not, which is a clear Dependabot oversight rather than intentional pinning.\n\nImpact. No runtime impact — GitHub Actions resolves the SHA, and 27d5ce7f... will correctly run v5.0.5 of actions/cache regardless of what the comment says. The cost is purely auditability: a future reviewer reading actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.4 will believe the pin is at v5.0.4 and may waste time tracing the discrepancy, or fail to notice that v5.0.5 is actually deployed when triaging behavior changes (e.g. the v5.0.5 ts-http-runtime bump).\n\nFix. Change # v5.0.4 to # v5.0.5 on line 49 of .github/workflows/ci.yml. No other change needed.\n\nStep-by-step proof.\n1. Open the diff for .github/workflows/ci.yml line 49: it reads - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.4 # zizmor: ignore[cache-poisoning]. The @SHA was changed (was 668228422ae6...); the # v5.0.4 comment was not.\n2. Confirm the new SHA's release. The PR description quotes the actions/cache v5.0.5 release notes, which list a single commit: 27d5ce7 — "Merge pull request #1747 from actions/yacaovsnc/update-dependency". That is the commit being pinned.\n3. Confirm the PR's intent. The PR description's header for this action reads "Updates actions/cache from 5.0.4 to 5.0.5", so the target version is unambiguously v5.0.5.\n4. Cross-check against sibling bumps in the same diff: every other action comment matches its SHA's release tag. Only line 49 is mismatched.\n5. Therefore the comment # v5.0.4 on line 49 is stale and should read # v5.0.5.\n\nAll four independent verifiers confirmed this with nit severity. Filing as nit (cosmetic, comment-only).

name: Cache mypy cache
with:
path: ./.mypy_cache
Expand Down Expand Up @@ -82,7 +82,7 @@
with:
persist-credentials: false
- name: Install uv and set Python version
uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
version: "0.11.2"
python-version: ${{ matrix.python-version }}
Expand Down Expand Up @@ -145,7 +145,7 @@
with:
persist-credentials: false
- name: Install uv and set Python version
uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
version: "0.11.2"
python-version: "3.13"
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ jobs:

# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}
Expand Down Expand Up @@ -89,6 +89,6 @@ jobs:
exit 1

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
with:
category: "/language:${{matrix.language}}"
2 changes: 1 addition & 1 deletion .github/workflows/dependabot-merge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ jobs:
steps:
- name: Dependabot metadata
id: metadata
uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # v3.0.0
uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
with:
github-token: "${{ secrets.GITHUB_TOKEN }}"
- name: Enable auto-merge for Dependabot PRs
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ jobs:
persist-credentials: false

- name: Install uv and set Python version
uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
version: "0.11.2"
python-version: "3.12"
Expand Down
Loading