Skip to content

Bump the github-actions group across 1 directory with 4 updates - #254

Merged
1 commit merged into
mainfrom
dependabot/github_actions/github-actions-766f7dfba3
Oct 4, 2026
Merged

Bump the github-actions group across 1 directory with 4 updates#254
1 commit merged into
mainfrom
dependabot/github_actions/github-actions-766f7dfba3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 4 updates in the / directory: actions/checkout, actions/setup-python, actions/upload-artifact and leanprover/lean-action.

Updates actions/checkout from 4.4.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

... (truncated)

Commits

Updates actions/setup-python from 5.6.0 to 7.0.0

Release notes

Sourced from actions/setup-python's releases.

v7.0.0

What's Changed

Enhancements

Bug Fix

Dependency Upgrade

New Contributors

Full Changelog: actions/setup-python@v6...v7.0.0

v6.3.0

What's Changed

Enhancement

Dependency update

Documentation

New Contributors

Full Changelog: actions/setup-python@v6.2.0...v6.3.0

v6.2.0

What's Changed

Dependency Upgrades

... (truncated)

Commits

Updates actions/upload-artifact from 4.6.2 to 7.0.1

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.1

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates leanprover/lean-action from 1.6.0 to 1.6.1

Release notes

Sourced from leanprover/lean-action's releases.

v1.6.1

Changed

  • pin the actions/cache steps, and all actions used by this repository's workflows, to full commit SHAs, so that lean-action works in organizations that require SHA-pinned actions
Changelog

Sourced from leanprover/lean-action's changelog.

Changelog

All notable changes to lean-action will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

Unreleased

v1.6.1 - 2026-10-02

Changed

  • pin the actions/cache steps, and all actions used by this repository's workflows, to full commit SHAs, so that lean-action works in organizations that require SHA-pinned actions

v1.6.0 - 2026-08-22

Added

  • new leanchecker-args input to pass arguments to lake env leanchecker, e.g. leanchecker-args: "-v" for verbose output or explicit module prefixes such as leanchecker-args: "MyPkg.Core" to narrow the set of modules checked
  • new axiom-audit input to audit the project's axioms with axiom-audit: fail if any declaration depends on an axiom outside the allowlist (catches sorry, native_decide, and home-rolled axioms). Default: false
  • new axiom-audit-allow input for the allowlist (default: propext,Classical.choice,Quot.sound)
  • new axiom-audit-root input to set the audited root namespace (default: the lakefile's library name)
  • new axiom-audit-status output parameter
  • new lint-args input to specify arguments to pass to lake lint
  • new mk_all-args input to pass arguments to lake exe mk_all --check, e.g. mk_all-args: "--lib Carleson" to restrict the check to a specific library
  • new release.yml workflow which automates the release process (see RELEASING.md)

Fixed

  • include lake-package-directory when hashing lean-toolchain and lake-manifest.json for the GitHub cache key, so projects whose Lake package lives in a subdirectory get a version-specific key instead of an empty one (the empty key previously caused stale, cross-version cache restores)
  • use a more portable shebang, useful for self-hosted runners

v1.5.0 - 2026-04-21

Added

  • new nanoda input to check environment with nanoda external type checker
  • new nanoda-allow-sorry input to permit sorryAx axiom when running nanoda (default: true)
  • new nanoda-status output parameter
  • new reusable workflow nanoda-daily.yml for scheduled daily verification with notifications

Changed

  • rename the lean4checker input to leanchecker, while keeping lean4checker as a deprecated alias
  • use the bundled leanchecker binary on Lean nightly-2026-01-09 / v4.28.0-rc1 and newer, with fallback to the external lean4checker repository on older toolchains

Fixed

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 3, 2026
@dependabot
dependabot Bot requested a review from d6g8k5htny-coder as a code owner October 3, 2026 19:55
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 3, 2026
@dependabot
Bump the github-actions group across 1 directory with 4 updates
6b254fd 
Bumps the github-actions group with 4 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-python](https://github.com/actions/setup-python), [actions/upload-artifact](https://github.com/actions/upload-artifact) and [leanprover/lean-action](https://github.com/leanprover/lean-action).


Updates `actions/checkout` from 4.4.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](actions/checkout@v4.4.0...v7.0.1)

Updates `actions/setup-python` from 5.6.0 to 7.0.0
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5.6.0...v7)

Updates `actions/upload-artifact` from 4.6.2 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4.6.2...v7.0.1)

Updates `leanprover/lean-action` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/leanprover/lean-action/releases)
- [Changelog](https://github.com/leanprover/lean-action/blob/main/CHANGELOG.md)
- [Commits](leanprover/lean-action@50fcf42...f061402)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-python
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: leanprover/lean-action
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the github-actions group with 4 updates Bump the github-actions group across 1 directory with 4 updates Oct 4, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-766f7dfba3 branch from b48bb9f to 6b254fd Compare October 4, 2026 00:15
@d6g8k5htny-coder ChatGPT Codex Connector

d6g8k5htny-coder commented Oct 4, 2026

Copy link
Copy Markdown
Owner

Bounded nonauthor engineering review pickup, OpenAI/Codex /root/actions254_review_20261004, delegated by Dylan Roy's request to find and assist additional actionable work. Exact head 6b254fdea04212df371c0b48484be247b95580f0; scope is the 101 workflow diffs, upstream action pins/runtime/input compatibility, retained required-check wiring and complete paginated hosted check inventory. No branch update, ownership of other PRs, new mathematical review or merge reservation. Current PR discussion/reviews show no competing pickup. I will publish a source-bound disposition with explicit limits and release; scientific effect NONE.

@d6g8k5htny-coder ChatGPT Codex Connector

d6g8k5htny-coder commented Oct 4, 2026

Copy link
Copy Markdown
Owner

SCOPED ENGINEERING REVIEW — PASS for the reviewed dependency delta; current-base integration still required.

Reviewer: OpenAI/Codex /root/actions254_review_20261004, delegated by Dylan Roy. This is a nonauthor review of Dependabot's change, using the owner's GitHub identity; organizational-independence credit 0. Scientific effect NONE.

Source: head 6b254fd. Inspected both changed-file pages (100+1): all 101 files are workflows; every added/deleted line is an action-reference substitution (204 substitutions). No commands, triggers, permissions, input values, check names, receipt binding, proof bodies, or scientific fields change.

Compatibility findings:

  • Verified upstream release refs and action.yml at checkout v7.0.1 / 3d3c42e5aac5ba805825da76410c181273ba90b1; setup-python v7.0.0 / 5fda3b95a4ea91299a34e894583c3862153e4b97; upload-artifact v7.0.1 / 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a; lean-action v1.6.1 / f061402b660e0c34644504b324e830f2991d4865.
  • Existing full-SHA pins remain full-SHA pins; the three tag-based substitutions retain pre-existing tag-based use.
  • The JavaScript actions use Node24. Repository jobs use hosted ubuntu-latest / ubuntu-24.04; the inspected aggregate execution reports runner2.337.0. No self-hosted runner, removed pip-install input, pull_request_target/workflow_run checkout path, explicit archive:false, or download-artifact consumer occurs in the workflow inventory.
  • Artifact names/paths/hidden-file settings remain unchanged; upstream archive defaults true.
  • Upstream lean-action comparison changes the consumed composite only by pinning cache/restore and cache/save. No consumed script changes; both repository callers already set use-github-cache:false. Pinned Lean/mathlib and explicit gate execution remain intact.
  • Required-check wiring and current-tested-commit/run/attempt/receipt binding remain unchanged.

Observed validation:

  • Complete paginated hosted inventory:105/105 check runs SUCCESS at the reviewed head.
  • Required aggregate job111324751459, run37164409513 attempt1, binds both dependencies to tested merge cce6748; receipt SHA256 b6b1d183612f3b763a454fb5a55e04cff1891562af1df85d45e7969b2fd4fe43. Formal job111324276301 is SUCCESS.
  • Exact-head local root suite:54 tests PASS in normal Python and54 PASS under -O. This is the test inventory on this older branch, not the larger successor-main/navigation inventory.

Integration limit: fresh native read still reports OPEN / behind, base af43e80, while main is42f19d7dc4109c2359520b7cbde24b6bb1fca110. These older successful receipts do not certify a future base refresh. Before landing: reconcile current integration ownership, refresh onto the then-current base, inspect any merge resolution and newly introduced workflows, obtain fresh required aggregate/dependencies on that tested merge, reread threads/checks, and use expected-head merge protection. This review is reusable only for the unchanged reviewed delta.

Limits: compatibility review and observed execution, not an exhaustive third-party source/security audit, fresh mathematical review, formal-alignment review, or theorem acceptance. No branch mutation or merge was performed. No finding requires changing the reviewed dependency substitutions.

RELEASE: read-only pickup5975452265 is complete; no writer or merge reservation remains.

@d6g8k5htny-coder ChatGPT Codex Connector

d6g8k5htny-coder commented Oct 4, 2026

Copy link
Copy Markdown
Owner

Current-base preparation update (read-only, no branch claim): after #178 landed, I independently ran git merge-tree of reviewed head6b254fdea04212df371c0b48484be247b95580f0 with main034b1e21189eed97af7108e0c463ee1173573f25. It is conflict-free and produces local tree7cd1922515ec4e8b382a1f7c41364d616851cb37. Against that main cut, exactly101 workflows differ; stripping only uses: lines gives byte-equivalent remaining line content, with no non-workflow changes. This narrows the base-refresh risk and preserves review5975466898's scope. No remote branch was changed, no successor hosted checks ran, and this is not a merge-ready receipt. Next integrator still needs a current ownership/head/base check, normal branch refresh, full paginated current CI and expected-head protected merge. OpenAI/Codex /root/ready178_20261004; scientific effect NONE.

@d6g8k5htny-coder ChatGPT Codex Connector

d6g8k5htny-coder commented Oct 4, 2026

Copy link
Copy Markdown
Owner

Actual integration pickup — OpenAI/Codex /root/merge_queue_20261004 under Dylan Roy's direct merge instruction. Current head6b254fdea04212df371c0b48484be247b95580f0, no competing native claimant in current read. I retain scoped review5975466898 and current-base comparison5976103793, and will include this exact action-pin patch in integration PR#268 so its full workflow validation occurs on the same tree as the seven already-claimed packets. Scope: preserve #254 as an ancestor, exactly its reviewed uses-line substitutions in101 existing workflows, no other current-main changes, unchanged mathematical packet bytes, every applicable current workflow success and protected expected-head merge. Original Dependabot branch untouched. This adds one engineering-only scope to the integration claim; no scientific promotion or new mathematical review.

d6g8k5htny-coder added a commit that referenced this pull request Oct 4, 2026
@d6g8k5htny-coder
Include reviewed Actions updates in the combined integration
2d6e16d 
Retain #254 head6b254fdea04212df371c0b48484be247b95580f0 as a parent. Exact merge-tree; 101 existing workflows contain only the original 206 uses-line substitutions. All62 mathematical packet/workflow additions remain byte-identical. No proof or scientific-status edit.

Actual integration performer: OpenAI/Codex /root/merge_queue_20261004. Prior scoped review5975466898 reused for unchanged patch; all combined-tree CI required.
@d6g8k5htny-coder d6g8k5htny-coder mentioned this pull request Oct 4, 2026
Merged
d6g8k5htny-coder added a commit that referenced this pull request Oct 4, 2026
@d6g8k5htny-coder
Merge current main into reviewed C8/C6 integration
cb36741 
Preserve the original seven packet heads and all62 additions; preserve #254's101-workflow patch unchanged. Carry both intervening main landings without source changes. Require fresh exact-commit checks.

Scientific effect NONE. Actual OpenAI/Codex /root/merge_queue_20261004; integration only.
@d6g8k5htny-coder d6g8k5htny-coder mentioned this pull request Oct 4, 2026
Merged
d6g8k5htny-coder added a commit that referenced this pull request Oct 4, 2026
@d6g8k5htny-coder
Refresh repaired C8/C6 integration onto landed follow-up batch
458d4da 
Retain the exact 101-file #254 Actions patch and 63 packet additions, including INT-268-01..02 engineering repairs. Preserve all other 1529-base-tree entries, original proof/results/scientific fields and original PR ancestry. Recheck 146 identities, 36 current source pins and seven recorded packet-copy bindings. Fresh full CI is required; historical receipts do not authorize this merge. Scientific effect NONE.
@d6g8k5htny-coder d6g8k5htny-coder closed this pull request by merging all changes into main in dbe0b91 Oct 4, 2026
@d6g8k5htny-coder
d6g8k5htny-coder deleted the dependabot/github_actions/github-actions-766f7dfba3 branch October 4, 2026 05:07
This was referenced Oct 4, 2026
Merged
Merged
Merged
Merged
Merged
Merged
@d6g8k5htny-coder ChatGPT Codex Connector

d6g8k5htny-coder commented Oct 4, 2026

Copy link
Copy Markdown
Owner

Integration complete and native pickup released through #268, merged normally at dbe0b918ec202895f26673b4e75a387d70a03fb5 after115/115 current premerge and24/24 landed push checks passed. Exact original head 6b254fdea04212df371c0b48484be247b95580f0 is retained as an ancestor; this PR is GitHub-merged at that commit.

Engineering scope pickup5976197545 is complete. The exact original patch is retained:206 uses substitutions across101 existing workflow files, with every other line in that original patch unchanged. The seven new packet workflows retain their own pins. All115 combined current premerge jobs passed; this is engineering integration, not scientific acceptance.

Append-only R17 Work Events778 releases WE761 and its native #254 scope extension; all14 values, formatting and adjacent rows were read back, with one expected native URL autolink. Original scientific scope/status and historical review limits remain; scientific effect NONE. Actual OpenAI/Codex /root/merge_queue_20261004, source-exposed engineering, organizational independence0.

@d6g8k5htny-coder d6g8k5htny-coder mentioned this pull request Oct 4, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@d6g8k5htny-coder d6g8k5htny-coder Awaiting requested review from d6g8k5htny-coder d6g8k5htny-coder is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@d6g8k5htny-coder