Bump the github-actions group with 3 updates#56870
Conversation
|
This PR doesn't have any linked issues. Please open an issue that references this PR. From there we can discuss and prioritise. |
1 similar comment
|
This PR doesn't have any linked issues. Please open an issue that references this PR. From there we can discuss and prioritise. |
5745045 to
d9cabbf
Compare
sandersn
left a comment
There was a problem hiding this comment.
I'd like one other sign off so at least two people are aware that (for example) codeql is updating from 2.22 to 3.22
jakebailey
left a comment
There was a problem hiding this comment.
Actually, this fails CI. Some line endings are wrong. Will have to look into that.
|
How can somebody investigate this? I'm not sure how to replicate what dependabot does locally. |
|
It's likely that the files are CRLF but dependabot emits LF (good) unconditionally. The fix is to just switch the files to be the other line endings and let them be that way. The confusing part is that that change is not showing in the diff here, which usually happens |
|
What I believe is happening here is a bug in dependabot. It is modifying the file in place but using the wrong newline for the change. Each of the files that are being flagged by dprint are CRLF, so if dependabot replaces the line using an LF, diff viewers may not actually notice. But, since dprint is trying to make it consistent within a file (back to CRLF), it fails in CI and locally, producing a confusing diff like: diff --git a/.github/workflows/new-release-branch.yaml b/.github/workflows/new-release-branch.yaml
index cfd8142c00..1183bf24df 100644
--- a/.github/workflows/new-release-branch.yaml
+++ b/.github/workflows/new-release-branch.yaml
@@ -23,7 +23,7 @@ jobs:
filter: blob:none # https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/
fetch-depth: 0 # Default is 1; need to set to 0 to get the benefits of blob:none.
token: ${{ secrets.TS_BOT_GITHUB_TOKEN }}
- - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
+ - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
- run: |
npm --version
# corepack enable npmBut, you can see that there's a missing
I've filed this on dependabot as dependabot/dependabot-core#8693, but for a quick fix locally the only workaround is to reformat these files as |
|
@dependabot rebase |
Bumps the github-actions group with 3 updates: [actions/setup-node](https://github.com/actions/setup-node), [github/codeql-action](https://github.com/github/codeql-action) and [actions/upload-artifact](https://github.com/actions/upload-artifact). Updates `actions/setup-node` from 4.0.0 to 4.0.1 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@8f152de...b39b52d) Updates `github/codeql-action` from 2.22.9 to 3.22.12 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c0d1daa...012739e) Updates `actions/upload-artifact` from 3.1.3 to 4.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@a8a3f3a...c7d193f) --- updated-dependencies: - dependency-name: actions/setup-node dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
d9cabbf to
25be907
Compare
Bumps the github-actions group with 3 updates: actions/setup-node, github/codeql-action and actions/upload-artifact.
Updates
actions/setup-nodefrom 4.0.0 to 4.0.1Release notes
Sourced from actions/setup-node's releases.
Commits
b39b52dFix node-version-file interprets entire package.json as a version (#865)7247617Addpackage.jsontonode-version-filelist of examples. (#879)f3ec4caFix README.md (#898)ec97f37Add fix for cache (#917)5ef044fUpdate reusable workflows to use Node.js v20 (#889)c45882aupdate to setup-node@v4 in docs (#884)ee36e8bIgnore engines check in Yarn 1 e2e-cache tests (#882)Updates
github/codeql-actionfrom 2.22.9 to 3.22.12Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
012739eMerge pull request #2052 from github/update-v3.22.12-40cb08c12c1cf794Update changelog for v3.22.1240cb08cMerge pull request #2051 from github/angelapwen/patch-release-script0be9290TypecastOLDEST_SUPPORTED_MAJOR_VERSIONwhen defined658e3c6Fix type error49812ecMerge pull request #2050 from github/nickfyson/add-releases-ini9ed5fc7add note about backporting check changes to v2 brancha42c9a2update required checks script to handle release branchesa110746Merge pull request #2047 from github/update-bundle/codeql-bundle-v2.15.5a99bd84Add changelog noteUpdates
actions/upload-artifactfrom 3.1.3 to 4.0.0Release notes
Sourced from actions/upload-artifact's releases.
Commits
c7d193fMerge pull request #466 from actions/v4-beta13131bblicensed cache4a6c273Merge branch 'main' into v4-betaf391bb9Merge pull request #465 from actions/robherley/v4-documentation9653d03Apply suggestions from code review875b630add limitations sectionecb2146add compression example5e7604ftrim some repeated infod6437d0naming1b56155s/v4-beta/v4/gDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions