Repository navigation
chore(deps): bump the actions group across 1 directory with 2 updates - #937
Merged
Merged
Conversation
dependabot
Bot
added
dependencies
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-46a2891f25
branch
4 times, most recently
from
October 20, 2026 13:42
66e0db8 to
6bb3d41
Compare
6 of 7 tasks
Bumps the actions group with 2 updates in the / directory: [taiki-e/install-action](https://github.com/taiki-e/install-action) and [actions/setup-java](https://github.com/actions/setup-java). Updates `taiki-e/install-action` from 2.87.28 to 2.87.29 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@v2.87.28...v2.87.29) Updates `actions/setup-java` from 6.0.1 to 6.1.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@v6.0.1...v6.1.0) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: taiki-e/install-action dependency-version: 2.87.29 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-46a2891f25
branch
from
October 20, 2026 14:15
6bb3d41 to
76e5ddd
Compare
hyperpolymath
approved these changes
Oct 20, 2026
hyperpolymath
added a commit
that referenced
this pull request
Oct 20, 2026
## Summary **Regression fix for main.** #945 brought in `step-security/harden-runner@v2.22.2` (from #946) in 3 workflows, but `actions.lock` has **no record** for it. On main, `grep -c harden-runner .github/workflows/actions.lock` gives 0. GitHub rejects unlocked actions at startup, so: - **Dependabot Auto-Merge ends in `startup_failure` on every PR** since 13:34 UTC, including Dependabot's own #937 (runs 39431585232, 39431759488, 39432798311). - `ci-health-sweep` and `roadmap-sync` will fail the same way on their next scheduled or dispatched run. This PR restores `ci-health-sweep.yml`, `dependabot-automerge.yml` and `roadmap-sync.yml` byte-for-byte to their state before #945 (`551b4c4`), removing only the 8-line harden-runner step from each. **Alternative:** if you'd rather keep the hardening, close this PR and run `gh actions-lock` on main. That adds the record (tag `v2.22.2` → `dc2769ab…`) and fixes the same failure. Either fixes main; this PR is the one I can push without a `gh` credential. The RE001 findings for these 3 jobs come back with this PR. Re-adding harden-runner and the lock regeneration should land in **one** change. ## Type of change - [x] 🐛 Bug fix (CI regression) - [x] 🔧 Build / CI / tooling ## How has this been verified? - `git diff 551b4c4 -- <3 files>` on this branch is empty: the files are identical to their pre-#945 state. - `actionlint` 1.7.7 gives 0, 1 and 3 messages, the same pre-existing counts as before #945. - On main, `dependabot-automerge.yml` runs `startup_failure` on each of its last 3 runs (listed above). This PR's own Dependabot Auto-Merge run is the end-to-end check. ## Checklist - [ ] My commits are **signed**. The session's signing shim is platform-mediated. - [x] I ran the project's own checks/tests locally and they pass. - [x] New files carry the correct SPDX (none added). - [x] Docs are updated, and no public claim now overstates what the code does. - [x] I have not introduced a soundness hole. --- _Generated by [Claude Code](https://claude.ai/code/session_01CYR5bf5FBLS7cXQK72aVNM)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 2 updates in the / directory: taiki-e/install-action and actions/setup-java.
Updates
taiki-e/install-actionfrom 2.87.28 to 2.87.29Release notes
Sourced from taiki-e/install-action's releases.
Changelog
Sourced from taiki-e/install-action's changelog.
Commits
8cca091Release 2.87.29fc26824Update wasmtime manifest5018b2eUpdatezizmor@latestto 1.31.0d0e5204Updatewasmtime@latestto 49.0.3517774fUpdatewasm-tools@latestto 1.262.04bc69b1Update vacuum manifest0470a3fUpdateuv@latestto 0.13.17a2b747Updatetrivy@latestto 0.76.07efb533Updatetombi@latestto 1.8.4e5d37d6Updaterelease-plz@latestto 0.3.172Updates
actions/setup-javafrom 6.0.1 to 6.1.0Release notes
Sourced from actions/setup-java's releases.
Commits
b843ebfSupport Maven plugin repositories in generated settings.xml (#1286)2a69be2feat: support Maven server credential origins (#1282)d0e6e4dchore(deps): bump the monthly-npm-updates group with 13 updates (#1276)b24925bchore(deps): bump undici from 6.28.0 to 6.29.0 (#1274)47b3648Support Temurin JEP 322 patch versions like 26.0.2.1+1 (#1270) (#1279)74920aaPrefer Zulu 4-segment hotfix builds when resolving version ranges (#1278)a78ec39Stop GPG agent before removing signature-verification home (#1273)97c5a5eSupport Temurin on Linux RISC-V (#1269)1aa87b6Preserve compound Liberica build versions from .sdkmanrc (#1268)