Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump all outdated actions #300

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 22, 2024

Bumps actions/checkout from 3df4ab11eba7bda6032a0b82a6bb43b11571feac to aadec899646c8e0f34c52d9219c2faac36626b55.

Changelog

Sourced from actions/checkout's changelog.

Changelog

v4.1.0

v4.0.0

v3.6.0

v3.5.3

v3.5.2

v3.5.1

v3.5.0

v3.4.0

v3.3.0

v3.2.0

v3.1.0

v3.0.2

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [actions/checkout](https://github.com/actions/checkout) from 3df4ab11eba7bda6032a0b82a6bb43b11571feac to aadec899646c8e0f34c52d9219c2faac36626b55.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@3df4ab1...aadec89)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Feb 22, 2024
@joshuagl joshuagl changed the title Bump actions/checkout from 3df4ab11eba7bda6032a0b82a6bb43b11571feac to aadec899646c8e0f34c52d9219c2faac36626b55 Bump all actions Feb 22, 2024
@joshuagl joshuagl changed the title Bump all actions Bump all outdated actions Feb 22, 2024
@joshuagl
Copy link
Member

I pushed a follow-on cleanup commit to this branch which ensures we're on the latest version of all the GHA we're using and adds a comment after the digest so we can more easily tell which version we're using. Dependabot will update the comments for us as it suggests bumps in future.

Ensure we're using the latest released version of all GitHub Actions
we're using, make it clear what version we have pinned.

Signed-off-by: Joshua Lock <joshuagloe@gmail.com>
@joshuagl joshuagl force-pushed the dependabot/github_actions/actions/checkout-aadec899646c8e0f34c52d9219c2faac36626b55 branch from 33d45df to a63f67e Compare February 22, 2024 10:27
@trishankatdatadog
Copy link
Member

Dependabot will update the comments for us as it suggests bumps in future.

Wasn't obvious why at all to me until I searched for it. Thanks for the PR!

@trishankatdatadog
Copy link
Member

@joshuagl I am confused about one thing. Why did dependabot choose something newer but unversion, but you chose something older but versioned?

@joshuagl
Copy link
Member

Great question @trishankatdatadog ! I believe dependabot resolved main (though two new commits have been made since then) whereas I am pinning to a release.

Copy link
Contributor Author

dependabot bot commented on behalf of github Feb 23, 2024

A newer version of actions/checkout exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

@trishankatdatadog
Copy link
Member

Great question @trishankatdatadog ! I believe dependabot resolved main (though two new commits have been made since then) whereas I am pinning to a release.

Yeap, looks like it. Out of curiosity, did you resolve the hashes/versions manually or did you use tooling?

@joshuagl
Copy link
Member

I was playing around with frizbee a bit, so I got the hashes automatically but verified them by eye.

@trishankatdatadog
Copy link
Member

I was playing around with frizbee a bit, so I got the hashes automatically but verified them by eye.

Useful tip, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants