build(deps): bump peter-evans/create-pull-request from 6.0.5 to 7.0.9 by dependabot[bot] · Pull Request #224 · DeterminateSystems/update-flake-lock

dependabot · 2025-11-24T01:04:17Z

Bumps peter-evans/create-pull-request from 6.0.5 to 7.0.9.

Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v7.0.9

⚙️ Fixes an incompatibility with the recently released actions/checkout@v6.

What's Changed

~70 dependency updates by @dependabot

docs: fix workaround description about ready_for_review by @ybiquitous in peter-evans/create-pull-request#3939

Docs: add-paths default behavior by @joeflack4 in peter-evans/create-pull-request#3928

docs: update to create-github-app-token v2 by @Goooler in peter-evans/create-pull-request#4063

Fix compatibility with actions/checkout@v6 by @ericsciple in peter-evans/create-pull-request#4230

New Contributors

@joeflack4 made their first contribution in peter-evans/create-pull-request#3928

@Goooler made their first contribution in peter-evans/create-pull-request#4063

@ericsciple made their first contribution in peter-evans/create-pull-request#4230

Full Changelog: peter-evans/create-pull-request@v7.0.8...v7.0.9

Create Pull Request v7.0.8

What's Changed

build(deps-dev): bump ts-jest from 29.2.5 to 29.2.6 by @dependabot in peter-evans/create-pull-request#3751

build(deps-dev): bump eslint-import-resolver-typescript from 3.8.1 to 3.8.3 by @dependabot in peter-evans/create-pull-request#3752

build(deps): bump @octokit/plugin-paginate-rest from 11.4.2 to 11.4.3 by @dependabot in peter-evans/create-pull-request#3753

build(deps-dev): bump prettier from 3.5.1 to 3.5.2 by @dependabot in peter-evans/create-pull-request#3754

fix: suppress output for some git operations by @peter-evans in peter-evans/create-pull-request#3776

Full Changelog: peter-evans/create-pull-request@v7.0.7...v7.0.8

Create Pull Request v7.0.7

⚙️ Fixes an issue with commit signing where modifications to the same file in multiple commits squash into the first commit.

What's Changed

build(deps): bump @octokit/core from 6.1.2 to 6.1.3 by @dependabot in peter-evans/create-pull-request#3593

build(deps-dev): bump @types/node from 18.19.68 to 18.19.70 by @dependabot in peter-evans/create-pull-request#3594

Update distribution by @actions-bot in peter-evans/create-pull-request#3603

build(deps-dev): bump typescript from 5.7.2 to 5.7.3 by @dependabot in peter-evans/create-pull-request#3610

build(deps): bump octokit dependencies by @peter-evans in peter-evans/create-pull-request#3618

docs: add workflow tip for showing message via workflow command by @ybiquitous in peter-evans/create-pull-request#3626

build(deps-dev): bump eslint-plugin-prettier from 5.2.1 to 5.2.3 by @dependabot in peter-evans/create-pull-request#3628

build(deps): bump node-fetch-native from 1.6.4 to 1.6.6 by @dependabot in peter-evans/create-pull-request#3627

build(deps-dev): bump undici from 6.21.0 to 6.21.1 by @dependabot in peter-evans/create-pull-request#3630

build(deps-dev): bump @types/node from 18.19.70 to 18.19.71 by @dependabot in peter-evans/create-pull-request#3629

Update distribution by @actions-bot in peter-evans/create-pull-request#3647

build(deps-dev): bump @types/node from 18.19.71 to 18.19.74 by @dependabot in peter-evans/create-pull-request#3657

build(deps-dev): bump @types/node from 18.19.74 to 18.19.75 by @dependabot in peter-evans/create-pull-request#3663

build(deps): bump @octokit/plugin-rest-endpoint-methods from 13.3.0 to 13.3.1 by @dependabot in peter-evans/create-pull-request#3670

build(deps-dev): bump prettier from 3.4.2 to 3.5.0 by @dependabot in peter-evans/create-pull-request#3671

Update distribution by @actions-bot in peter-evans/create-pull-request#3680

build(deps): bump @octokit/request-error from 6.1.6 to 6.1.7 by @dependabot in peter-evans/create-pull-request#3685

build(deps): bump @octokit/plugin-paginate-rest from 11.4.0 to 11.4.1 by @dependabot in peter-evans/create-pull-request#3688

... (truncated)

Commits

84ae59a fix: compatibility with actions/checkout@v6 (#4230)
b4733b9 build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#4222)
0edc001 build(deps-dev): bump the npm group with 2 updates (#4201)
430aea0 build(deps): bump the github-actions group with 3 updates (#4200)
46cdba7 build(deps-dev): bump the npm group with 3 updates (#4185)
b937339 build(deps): bump the github-actions group with 2 updates (#4184)
e9af275 ci: update dependabot config
d3e081a build(deps-dev): bump @types/node from 18.19.127 to 18.19.128 (#4178)
9ec683e build(deps-dev): bump @types/node from 18.19.125 to 18.19.127 (#4165)
65d8d10 build(deps-dev): bump ts-jest from 29.4.2 to 29.4.4 (#4163)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Fixes #223

Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 6.0.5 to 7.0.9. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](peter-evans/create-pull-request@6d6857d...84ae59a) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-version: 7.0.9 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2025-11-24T01:04:40Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

khaneliman · 2025-11-26T18:43:56Z

I believe this is needed for anyone to upgrade their workflow to use checkout@v6

…ility Root cause: DeterminateSystems/update-flake-lock@v27 uses peter-evans/create-pull-request@v6.0.5 internally, which is incompatible with actions/checkout@v6's new credential storage mechanism. The Problem Chain: - actions/checkout@v6 moved credentials from .git/config to $RUNNER_TEMP (security improvement) - peter-evans/create-pull-request@v6.0.5 cannot access credentials from the new $RUNNER_TEMP location - This causes exit code 128 when update-flake-lock tries to create PRs The Fix: - create-pull-request@v7.0.9 fixed v6 compatibility - However, update-flake-lock@v27 (released July 2025) hasn't upgraded yet - Reverting to v5 restores working credential access Testing: - Attempted quarto-dev git worktree credential propagation workaround - Testing confirmed it didn't resolve the issue - Root cause is in create-pull-request, not in our workflow Next Steps: - Can upgrade to v6 once update-flake-lock uses create-pull-request@v7.0.9+ - DeterminateSystems/update-flake-lock#224 - Dependabot configured to ignore v6 upgrades until compatibility is fixed Also adds release-25.11 to dependabot.yml for automated action updates on the current stable branch. Fixes: https://github.com/nix-community/home-manager/actions/runs/19712979574 See: peter-evans/create-pull-request#690 Signed-off-by: Austin Horstman <khaneliman12@gmail.com>

…ility Root cause: DeterminateSystems/update-flake-lock@v27 uses peter-evans/create-pull-request@v6.0.5 internally, which is incompatible with actions/checkout@v6's new credential storage mechanism. The Problem Chain: - actions/checkout@v6 moved credentials from .git/config to $RUNNER_TEMP (security improvement) - peter-evans/create-pull-request@v6.0.5 cannot access credentials from the new $RUNNER_TEMP location - This causes exit code 128 when update-flake-lock tries to create PRs The Fix: - create-pull-request@v7.0.9 fixed v6 compatibility - However, update-flake-lock@v27 (released July 2025) hasn't upgraded yet - Reverting to v5 restores working credential access Next Steps: - Can upgrade to v6 once update-flake-lock uses create-pull-request@v7.0.9+ - DeterminateSystems/update-flake-lock#224 - Dependabot configured to ignore v6 upgrades until compatibility is fixed Fixes: https://github.com/nix-community/home-manager/actions/runs/19712979574 See: peter-evans/create-pull-request#690 Signed-off-by: Austin Horstman <khaneliman12@gmail.com>

cole-h · 2025-11-26T20:31:52Z

I believe this is needed for anyone to upgrade their workflow to use checkout@v6

@khaneliman Any chance you could check if that is true (i.e. point at this PR and see if it works) and report back? I'd be happy to merge and cut a new release if that's the case.

Testing if DeterminateSystems/update-flake-lock#224 fixes the actions/checkout@v6 incompatibility by using the PR commit directly. If successful, this PR can be merged upstream to fix the issue. Signed-off-by: Austin Horstman <khaneliman12@gmail.com>

khaneliman · 2025-11-26T21:07:32Z

@cole-h pushed a commit and ran in my fork and seems to have worked
https://github.com/khaneliman/home-manager/actions/runs/19717390995/job/56492700233

cole-h · 2025-11-26T21:17:09Z

Thanks for checking!

…ility Root cause: DeterminateSystems/update-flake-lock@v27 uses peter-evans/create-pull-request@v6.0.5 internally, which is incompatible with actions/checkout@v6's new credential storage mechanism. The Problem Chain: - actions/checkout@v6 moved credentials from .git/config to $RUNNER_TEMP (security improvement) - peter-evans/create-pull-request@v6.0.5 cannot access credentials from the new $RUNNER_TEMP location - This causes exit code 128 when update-flake-lock tries to create PRs The Fix: - create-pull-request@v7.0.9 fixed v6 compatibility - However, update-flake-lock@v27 (released July 2025) hasn't upgraded yet - Reverting to v5 restores working credential access Next Steps: - Can upgrade to v6 once update-flake-lock uses create-pull-request@v7.0.9+ - DeterminateSystems/update-flake-lock#224 - Dependabot configured to ignore v6 upgrades until compatibility is fixed Fixes: https://github.com/nix-community/home-manager/actions/runs/19712979574 See: peter-evans/create-pull-request#690 Signed-off-by: Austin Horstman <khaneliman12@gmail.com>

dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 24, 2025

dependabot bot mentioned this pull request Nov 24, 2025

build(deps): bump peter-evans/create-pull-request from 6.0.5 to 7.0.8 #153

Closed

khaneliman mentioned this pull request Nov 26, 2025

ci: revert actions/checkout to v5 due to update-flake-lock incompatibility nix-community/home-manager#8223

Merged

9 tasks

cole-h approved these changes Nov 26, 2025

View reviewed changes

cole-h merged commit 834c491 into main Nov 26, 2025
3 checks passed

cole-h deleted the dependabot/github_actions/peter-evans/create-pull-request-7.0.9 branch November 26, 2025 21:17

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump peter-evans/create-pull-request from 6.0.5 to 7.0.9#224

build(deps): bump peter-evans/create-pull-request from 6.0.5 to 7.0.9#224
cole-h merged 1 commit intomainfrom
dependabot/github_actions/peter-evans/create-pull-request-7.0.9

dependabot bot commented on behalf of github Nov 24, 2025 •

edited by cole-h

Loading

Uh oh!

coderabbitai bot commented Nov 24, 2025

Review skipped

Uh oh!

khaneliman commented Nov 26, 2025

Uh oh!

cole-h commented Nov 26, 2025

Uh oh!

khaneliman commented Nov 26, 2025

Uh oh!

Uh oh!

cole-h commented Nov 26, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot bot commented on behalf of github Nov 24, 2025 • edited by cole-h Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Create Pull Request v7.0.9

What's Changed

New Contributors

Create Pull Request v7.0.8

What's Changed

Create Pull Request v7.0.7

What's Changed

Uh oh!

coderabbitai bot commented Nov 24, 2025

Review skipped

Uh oh!

khaneliman commented Nov 26, 2025

Uh oh!

cole-h commented Nov 26, 2025

Uh oh!

khaneliman commented Nov 26, 2025

Uh oh!

Uh oh!

cole-h commented Nov 26, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot bot commented on behalf of github Nov 24, 2025 •

edited by cole-h

Loading