[TASK] Add version comments to SHA-pinned GitHub Actions - #1328
Closed
CybotTM wants to merge 1 commit into
Closed
Conversation
Annotates every pinned action SHA in the six non-main workflows with its resolved release tag, verified via the GitHub API. No version or behavior changes; main.yaml is left to #1196. Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
This was referenced Jul 14, 2026
CybotTM
marked this pull request as draft
July 14, 2026 06:51
linawolf
pushed a commit
that referenced
this pull request
Jul 25, 2026
Adds a `github-actions` package ecosystem to `dependabot.yml`, using the same schedule and conventions as the existing composer and npm entries (daily 16:00 Europe/Berlin, `[TASK]` prefix, `dependencies` + ecosystem label — the `github-actions` label has been created). ## Why Action versions in the workflows have only ever been updated by hand — `dependabot.yml` has covered composer and npm exclusively since it was created in #236, and the pins were last refreshed manually (#1194, then the #1184 → #1328/#1329 split). With this entry, Dependabot takes that over: it bumps SHA pins **and keeps the trailing `# vX.Y.Z` comments in sync** (see e.g. the actions bumps in TYPO3-Documentation/.github#19, same org). Minor/patch action bumps then flow through the existing auto-approve/auto-merge workflows like composer/npm updates already do; majors wait for review. ## Coordination - Trivial textual conflict with #1265, which also edits `dependabot.yml` (composer `ignore` key fix) — whichever lands second rebases. - Best merged after #1328/#1329 so Dependabot starts from current, annotated pins rather than re-proposing the same bumps. Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
Member
|
I believe this is superseeded by the dependabot activation |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First part of the #1184 split (as suggested by @linawolf there and agreed in the team chat).
Since #1184 was opened, all actions in these six workflows have already been SHA-pinned on
main— what remains of the pinning half is the audit trail. This PR annotates every pinned SHA with its release tag, without changing any version:Each SHA→tag mapping was resolved via the GitHub API (
repos/<action>/tags), so the comments are verified, not copied.main.yamlis untouched — it belongs to #1196.The second part (version updates with a per-action risk table, as requested by @sbuerk) follows as a separate PR stacked on this one.