Repository navigation
ci(deps): bump actions/create-github-app-token from 3.2.0 to 3.3.0 - #598
Conversation
Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 3.2.0 to 3.3.0. - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md) - [Commits](actions/create-github-app-token@bcd2ba4...64ab729) --- updated-dependencies: - dependency-name: actions/create-github-app-token dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Warning Your comment is too long (maximum is 65536 characters), so the coverage report was not added. See the job log for how to reduce it. |
all-hands-bot
left a comment
all-hands-bot
left a comment
There was a problem hiding this comment.
This review was posted by an AI agent (OpenHands).
Scope. This change stays inside this repository: it updates a pinned GitHub Action reference in the repo-owned workflow .github/workflows/promote-to-development.yml, which is part of this service's own release/promotion tooling and not covered by the cross-repository ownership split in AGENTS.md.
What changed. One line: actions/create-github-app-token moves from bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 to 64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 - still a full-SHA pin with a version comment, matching the repository's existing pinning style.
Verification on this head.
- The new SHA resolves to the signed upstream
v3.3.0release commit (64ab729,chore(main): release 3.3.0 (#402), commit signatureverified: true), and thev3.3.0tag object points at that same commit. The version comment and the pinned SHA agree. - Upstream 3.2.0 to 3.3.0 diff for
action.ymlonly adds newpermission-*inputs and adjusts two descriptions; no input used by this workflow is renamed or removed. The only removal (permission-team-discussions) is not referenced here. The workflow passesapp-id,private-key,owner: OpenHands,repositories: saas-deploy, andpermission-contents: write, all of which remain valid in 3.3.0, so the minted token keeps the same least-privilege scope for thesaas-deploydispatch. - The file still parses as valid workflow YAML, the
yamlfmtpre-commit hook passes on the changed file, and no other tracked file is modified. - Focused workspace tests pass (
tests/test_dockerfile.py,tests/test_check_pr_description.py,tests/test_refresh_linked_pr_checks.py- 27 passed). - Current GitHub Actions results for this head are green:
unit-tests,backend,pr-title(label and conventional lint),Build and Push Automation Image, andcheck-pr-artifactssucceeded; the twoskippedjobs (Validate PR description,cleanup-after-merge) are conditional on other events, not failures.
No correctness, security, or compatibility defect found; this is a routine dependency bump with no behavior change for this workflow.
✅ APPROVED
all-hands-bot
left a comment
all-hands-bot
left a comment
There was a problem hiding this comment.
✅ Auto-approved by OpenHands: CI is green and the diff stays within the minimal-fix bounds (1 files, 2 changed lines).
This comment was posted by an AI agent (OpenHands).
Bumps actions/create-github-app-token from 3.2.0 to 3.3.0.
Release notes
Sourced from actions/create-github-app-token's releases.
Changelog
Sourced from actions/create-github-app-token's changelog.
Commits
64ab729chore(main): release 3.3.0 (#402)f3a828eci: create signed dist commits in release workflow (#404)655017fdocs: clarify when owner grants access to all repositories (#378)12461a3fix(deps): bump nested undici from 6.24.0 to 6.29.0 (#403)a47236ffeat: update permission inputs (#399)a69c19dfix(deps): bump the production-dependencies group across 1 directory with 3 u...d5cb7aebuild(deps): bump actions/checkout from 6 to 7 (#384)575da86build(deps): bump stefanzweifel/git-auto-commit-action from 7.1.0 to 7.2.0 in...e85f677test: omit stack traces from snapshots (#401)9419396build(deps-dev): bump c8 from 11.0.0 to 12.0.0 (#400)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)