Skip to content

chore(deps): bump the github-actions group across 1 directory with 10 updates #2533

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump the github-actions group across 1 directory with 10 updates #2533

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:

- name: Run Claude Code
id: claude
uses: anthropics/claude-code-action@2f8ba26a219c06cfb0f468eef8d97055fa814f97 # v1.0.53
uses: anthropics/claude-code-action@fefa07e9c665b7320f08c3b525980457f22f58aa # v1.0.111
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
use_commit_signing: true
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/comment-on-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,13 +13,13 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0

- name: Get previous release
id: previous_release
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
const currentTag = '${{ github.event.release.tag_name }}';
Expand Down Expand Up @@ -53,7 +53,7 @@ jobs:

- name: Get merged PRs between releases
id: get_prs
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
const currentTag = '${{ github.event.release.tag_name }}';
Expand Down Expand Up @@ -103,7 +103,7 @@ jobs:
return Array.from(prNumbers);

- name: Comment on PRs
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
with:
script: |
const prNumbers = ${{ steps.get_prs.outputs.result }};
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/conformance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,12 +18,12 @@ jobs:
runs-on: ubuntu-latest
continue-on-error: true
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
enable-cache: true
version: 0.9.5
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 24
- run: uv sync --frozen --all-extras --package mcp-everything-server
Expand All @@ -33,12 +33,12 @@ jobs:
runs-on: ubuntu-latest
continue-on-error: true
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
enable-cache: true
version: 0.9.5
- uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
with:
node-version: 24
- run: uv sync --frozen --all-extras --package mcp
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/publish-docs-manually.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,20 +9,20 @@ jobs:
permissions:
contents: write
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Configure Git Credentials
run: |
git config user.name github-actions[bot]
git config user.email 41898282+github-actions[bot]@users.noreply.github.com

- name: Install uv
uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
enable-cache: true
version: 0.9.5

- run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
key: mkdocs-material-${{ env.cache_id }}
path: .cache
Expand Down
16 changes: 8 additions & 8 deletions .github/workflows/publish-pypi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,10 @@ jobs:
runs-on: ubuntu-latest
needs: [checks]
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Install uv
uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
enable-cache: true
version: 0.9.5
Expand All @@ -25,7 +25,7 @@ jobs:
run: uv build

- name: Upload artifacts
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: release-dists
path: dist/
Expand All @@ -44,34 +44,34 @@ jobs:

steps:
- name: Retrieve release distributions
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: release-dists
path: dist/

- name: Publish package distributions to PyPI
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1

docs-publish:
runs-on: ubuntu-latest
needs: ["pypi-publish"]
permissions:
contents: write
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Configure Git Credentials
run: |
git config user.name github-actions[bot]
git config user.email 41898282+github-actions[bot]@users.noreply.github.com

- name: Install uv
uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
enable-cache: true
version: 0.9.5

- run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
- uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
key: mkdocs-material-${{ env.cache_id }}
path: .cache
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/shared.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,9 @@ jobs:
pre-commit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
enable-cache: true
version: 0.9.5
Expand Down Expand Up @@ -56,10 +56,10 @@ jobs:
os: [ubuntu-latest, windows-latest]

steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Install uv
uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
enable-cache: true
version: 0.9.5
Expand All @@ -82,9 +82,9 @@ jobs:
readme-snippets:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
enable-cache: true
version: 0.9.5
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/weekly-lockfile-update.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
- uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
version: 0.9.5

Expand All @@ -29,7 +29,7 @@
echo '```' >> pr_body.md

- name: Create pull request
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v7
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7

Check warning on line 32 in .github/workflows/weekly-lockfile-update.yml

View check run for this annotation

Claude / Claude Code Review

Stale version comment for peter-evans/create-pull-request 

The trailing comment `# v7` is stale — per the PR description this SHA corresponds to `peter-evans/create-pull-request` **v8.1.1**, so it's now off by a full major version. Dependabot likely skipped updating it because the bare `# v7` doesn't match its expected `# vX.Y.Z` format (note it correctly updated `# v7.2.1` → `# v8.1.0` for setup-uv in this same file). Since this line is being touched anyway, consider correcting it to `# v8.1.1` so dependabot keeps it in sync going forward.
Copy link
Copy Markdown
Contributor

@claude claude Bot May 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 The trailing comment # v7 is stale — per the PR description this SHA corresponds to peter-evans/create-pull-request v8.1.1, so it's now off by a full major version. Dependabot likely skipped updating it because the bare # v7 doesn't match its expected # vX.Y.Z format (note it correctly updated # v7.2.1 → # v8.1.0 for setup-uv in this same file). Since this line is being touched anyway, consider correcting it to # v8.1.1 so dependabot keeps it in sync going forward.

Extended reasoning...

What's wrong

Line 32 of .github/workflows/weekly-lockfile-update.yml is updated to:

uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7

The PR description explicitly states this bumps peter-evans/create-pull-request from 8.1.0 to 8.1.1, so SHA 5f6978fa… is v8.1.1. The trailing # v7 annotation is therefore wrong by a full major version.

Why dependabot didn't fix it

Dependabot updates trailing version comments when they match its expected exact-version format. Evidence from this very file: on line 19 it correctly rewrote # v7.2.1 → # v8.1.0 for astral-sh/setup-uv. But # v7 is a bare major-version tag that doesn't match that pattern, so dependabot left it untouched while updating the SHA. The mismatch was already present before this PR (the old SHA c0f553fe… was v8.1.0 with the same # v7 comment), and dependabot has now carried it forward again.

Why it's worth flagging here

The whole point of the # vX.Y.Z annotation next to a SHA pin is to give humans a readable indicator of which version is in use without having to resolve the hash. A comment that says v7 while the SHA is v8.1.1 actively misleads reviewers — for example, someone auditing whether the repo is affected by a v7-only CVE, or checking whether a v8 feature is available, would draw the wrong conclusion. Every other action pin touched by this PR has an accurate exact-version comment (# v6.0.2, # v8.1.0, # v9.0.0, # v5.0.5, etc.), so this one is inconsistent with the rest of the diff.

Step-by-step

  1. Before PR: peter-evans/create-pull-request@c0f553fe… # v7 (actually v8.1.0 — already stale).
  2. Dependabot bumps to v8.1.1 → rewrites SHA to 5f6978fa….
  3. Dependabot's comment-rewriter looks for an exact version like # v8.1.0 to replace; # v7 doesn't match, so it's preserved verbatim.
  4. Result: peter-evans/create-pull-request@5f6978fa… # v7 — SHA says v8.1.1, comment says v7.

Addressing the counter-argument

One could argue this is intentional shorthand, similar to # release/v1 used for pypa/gh-action-pypi-publish in publish-pypi.yml. However, # release/v1 annotates a SHA that genuinely tracks the release/v1 branch tip — the comment matches what's pinned. Here, # v7 does not match what's pinned (the SHA is on the v8 line), so it isn't a tracking-ref shorthand; it's simply stale. And because the bare-major format prevents dependabot from ever auto-correcting it, it will drift further on every future bump unless fixed manually.

Impact & fix

Zero functional impact — the workflow runs the correct v8.1.1 code regardless of the comment — hence nit severity. But since this PR already modifies the line, it's the natural place to correct it:

uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1

Using the exact-version format also lets dependabot maintain it automatically on subsequent bumps.

with:
commit-message: "chore: update uv.lock with latest dependencies"
sign-commits: true
Expand Down
Loading