Skip to content

ci(deps): bump the github-actions group across 1 directory with 10 updates - #37

Merged
mlevkov merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-46be05a2e4
Sep 23, 2026
Merged

ci(deps): bump the github-actions group across 1 directory with 10 updates#37
mlevkov merged 1 commit into
mainfrom
dependabot/github_actions/github-actions-46be05a2e4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the github-actions group with 10 updates in the / directory:

Package From To
actions/checkout 4 7
dtolnay/rust-toolchain fa04a1451ff1842e2626ccb99004d0195b455a88 02cb101ec7c40f2c49e1d9714d64511d8e1b74de
Swatinem/rust-cache e18b497796c12c097a38f9edb9d0641fb99eee32 f0d9c3887740aee45f6153b24b3a6b815192ec16
taiki-e/install-action 2.82.9 2.87.17
codecov/codecov-action 4.6.0 7.1.1
actions/upload-artifact 4 7
actions/download-artifact 4 8
softprops/action-gh-release 1 3
actions/upload-pages-artifact 3 5
actions/deploy-pages 4 5

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates dtolnay/rust-toolchain from fa04a1451ff1842e2626ccb99004d0195b455a88 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de

Commits
  • 02cb101 Merge pull request 185 from fufesou/feat/force-non-host
  • b38a663 Pass --force-non-host unconditionally
  • a4f61a0 Document rustup non-host opt-in requirement
  • 06b350f Support force-non-host toolchains
  • d103106 Predefine branches up to 1.120
  • 3ea7b2d Add 1.98.1 patch release
  • 6c977a6 Merge pull request #182 from dtolnay/name
  • f3510ff Render better step names
  • 2c7215f Add 1.97.1 patch release
  • See full diff in compare view

Updates Swatinem/rust-cache from e18b497796c12c097a38f9edb9d0641fb99eee32 to f0d9c3887740aee45f6153b24b3a6b815192ec16

Changelog

Sourced from Swatinem/rust-cache's changelog.

Changelog

2.9.2

  • Fix credentials.toml cleanup
  • Improvements to cleanup, preserving more valid targets
  • Improvements to cargo install handling
  • Correctly sort/dedupe Rust versions

2.9.1

  • Fix regression in hash calculation

2.9.0

  • Update to node24
  • Support running from within a nix shell
  • Consider all installed toolchains for cache key
  • Use case-insensitive comparison to determine exact cache hit

2.8.2

  • Don't overwrite env for cargo-metadata call

2.8.1

  • Set empty CARGO_ENCODED_RUSTFLAGS when retrieving metadata
  • Various dependency updates

2.8.0

  • Add support for warpbuild cache provider
  • Add new cache-workspace-crates feature

2.7.8

  • Include CPU arch in the cache key

2.7.7

  • Also cache cargo install metadata

2.7.6

  • Allow opting out of caching $CARGO_HOME/bin
  • Add runner OS in cache key
  • Adds an option to do lookup-only of the cache

2.7.5

... (truncated)

Commits
  • f0d9c38 Merge pull request #380 from Swatinem/dependabot/github_actions/actions-8ff58...
  • ccd9742 Bump the actions group with 2 updates
  • 258712b fix: stop cleanup timestamp pruning after the first entry (#377)
  • a45951f Merge pull request #373 from Swatinem/dependabot/github_actions/actions-420be...
  • b882611 Bump the actions group with 2 updates
  • 6323deb 2.9.2
  • b16e8d7 bump rollup and rebuild
  • 3bf42ac invert target/profile check in cleanup
  • 6e5b278 correctly sort and dedupe Rust versions
  • 5adc05f Bump the actions group across 1 directory with 3 updates (#368)
  • Additional commits viewable in compare view

Updates taiki-e/install-action from 2.82.9 to 2.87.17

Release notes

Sourced from taiki-e/install-action's releases.

2.87.17

  • Update uv@latest to 0.12.17.

  • Update release-plz@latest to 0.3.169.

  • Update kingfisher@latest to 2.5.0.

  • Update kache@latest to 0.25.0.

  • Update git-cliff@latest to 2.14.2.

  • Update cargo-tarpaulin@latest to 0.37.3.

  • Update cargo-leptos@latest to 0.3.9.

2.87.16

  • Update uv@latest to 0.12.16.

  • Update release-plz@latest to 0.3.168.

  • Update protoc@latest to 3.36.2.

  • Update mise@latest to 2026.9.11.

2.87.15

  • Update syft@latest to 1.52.0.

  • Update mise@latest to 2026.9.10.

  • Update kingfisher@latest to 2.4.0.

  • Update kache@latest to 0.23.1.

  • Update coreutils@latest to 0.12.0.

  • Update cargo-nextest@latest to 0.9.145.

2.87.14

  • Update vacuum@latest to 0.30.6.

  • Update uv@latest to 0.12.15.

  • Update typos@latest to 1.50.2.

  • Update sccache@latest to 0.18.0.

  • Update oxfmt@latest to 1.83.0.

  • Update mise@latest to 2026.9.9.

... (truncated)

Changelog

Sourced from taiki-e/install-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

This project adheres to Semantic Versioning.

[Unreleased]

[2.87.19] - 2026-09-23

  • Update wasmtime@latest to 49.0.0.

  • Update cargo-shear@latest to 1.13.5.

  • Update cargo-nextest@latest to 0.9.146.

[2.87.18] - 2026-09-22

  • Update oxfmt@latest to 1.84.0.

  • Update mise@latest to 2026.9.12.

  • Update kache@latest to 0.26.3.

  • Update cargo-tarpaulin@latest to 0.37.4.

  • Update cargo-rdme@latest to 2.2.3.

[2.87.17] - 2026-09-20

  • Update uv@latest to 0.12.17.

  • Update release-plz@latest to 0.3.169.

  • Update kingfisher@latest to 2.5.0.

  • Update kache@latest to 0.25.0.

  • Update git-cliff@latest to 2.14.2.

  • Update cargo-tarpaulin@latest to 0.37.3.

  • Update cargo-leptos@latest to 0.3.9.

[2.87.16] - 2026-09-19

... (truncated)

Commits
  • 94c31af Release 2.87.17
  • 475671f Update uv@latest to 0.12.17
  • eed0e36 Update release-plz@latest to 0.3.169
  • 28baa71 Update kingfisher@latest to 2.5.0
  • 2588b3f Update kache@latest to 0.25.0
  • 0d4ca4e Update git-cliff@latest to 2.14.2
  • b96f11e Update cargo-tarpaulin@latest to 0.37.3
  • 18f7722 Update cargo-leptos@latest to 0.3.9
  • 9114bf4 Release 2.87.16
  • bef0ddf Update uv@latest to 0.12.16
  • Additional commits viewable in compare view

Updates codecov/codecov-action from 4.6.0 to 7.1.1

Release notes

Sourced from codecov/codecov-action's releases.

v7.1.1

What's Changed

Full Changelog: codecov/codecov-action@v7.1.0...v7.1.1

v7.1.0

What's Changed

Full Changelog: codecov/codecov-action@v7.0.0...v7.1.0

v7.0.0

⚠️ Due to migration issues with keybase, we are unable to update our keys under the codecovsecurity account. We have deleted the account and are using codecovsecops with the original gpg key

What's Changed

Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0

v6.0.2

This is a copy of the v7.0.0 release to make updates easier

What's Changed

Full Changelog: codecov/codecov-action@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1

v6.0.0

⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️

What's Changed

... (truncated)

Changelog

Sourced from codecov/codecov-action's changelog.

v5.5.2

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2

v5.5.1

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1

v5.5.0

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0

v5.4.3

What's Changed

Full Changelog: https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3

v5.4.2

... (truncated)

Commits

Updates actions/upload-artifact from 4 to 7

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: actions/upload-artifact@v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

... (truncated)

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • b7c566a Merge pull request #745 from actions/upload-artifact-v6-release
  • e516bc8 docs: correct description of Node.js 24 support in README
  • Additional commits viewable in compare view

Updates actions/download-artifact from 4 to 8

Release notes

Sourced from actions/download-artifact's releases.

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

New Contributors

Full Changelog: actions/download-artifact@v6.0.0...v7.0.0

v6.0.0

... (truncated)

Commits
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • bd7976b Add a setting to specify what to do on hash mismatch and default it to error
  • ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
  • 15999bf Add note about package bumps
  • 974686e Bump the version to v8 and add release notes
  • fbe48b1 Update test names to make it clearer what they do
  • Additional commits viewable in compare view

Updates softprops/action-gh-release from 1 to 3

Release notes

Sourced from softprops/action-gh-release's releases.

v3.0.0

3.0.0 is a major release that moves the action runtime from Node 20 to Node 24. Use v3 on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on v2.6.2.

What's Changed

Other Changes 🔄

  • Move the action runtime and bundle target to Node 24
  • Update @types/node to the Node 24 line and allow future Dependabot updates
  • Keep the floating major tag on v3; v2 remains pinned to the latest 2.x release

v2.6.2

What's Changed

Other Changes 🔄

Full Changelog: softprops/action-gh-release@v2...v2.6.2

v2.6.1

2.6.1 is a patch release focused on restoring linked discussion thread creation when discussion_category_name is set. It fixes [#764](https://github.com/softprops/action-gh-release/issues/764), where the draft-first publish flow stopped carrying the discussion category through the final publish step.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

Bug fixes 🐛

v2.6.0

2.6.0 is a minor release centered on previous_tag support for generate_release_notes, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a working_directory docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.

If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.

What's Changed

... (truncated)

Changelog

Sourced from softprops/action-gh-release's changelog.

3.0.3

3.0.3 is a maintenance release with updated dependencies. It also safely classifies malformed GitHub API errors to avoid secondary failures (#822).

What's Changed

Bug fixes 🐛

Other Changes 🔄

  • dependency updates

3.0.2

3.0.2 is a patch release focused on release reliability and compatibility. It reuses existing draft releases when publishing prereleases, supports replacing release assets on Gitea, hardens streamed asset uploads, and provides clearer release-creation diagnostics. It also includes TypeScript, coverage, and tooling maintenance merged since 3.0.1.

This release fixes #795, #438, and #803. The upload transport hardening covers the historical failure reported in #790, although current hosted Node 24 runners did not reproduce it naturally. The diagnostics work is related to #786 and does not claim a reproducible release-creation fix.

What's Changed

Exciting New Features 🎉

Bug fixes 🐛

Other Changes 🔄

3.0.1

  • maintenance release with updated dependencies

... (truncated)

Commits
  • efb3536 release 3.0.3 (#840)
  • 6441963 chore(deps): bump the npm group with 2 updates (#839)
  • e5ee6bc chore(deps): bump esbuild from 0.28.1 to 0.28.2 in the npm group (#837)
  • d1e6617 chore(deps): bump undici from 6.27.0 to 6.28.0 (#831)
  • 6403751 chore(deps): bump the npm group with 2 updates (#835)
  • 7c7184b chore(deps): bump postcss from 8.5.19 to 8.5.25 (#833)
  • 0f3f0d2 chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 (#832)
  • 77fb938 chore(deps): bump prettier from 3.9.5 to 3.9.6 in the npm group (#830)
  • 5a6f517 chore(deps): bump brace-expansion from 5.0.7 to 5.0.8 (#828)
  • a3c91c9 chore(deps): bump the github-actions group with 2 updates (#825)
  • Additional commits viewable in compare view

Updates actions/upload-pages-artifact from 3 to 5

Release notes

Sourced from actions/upload-pages-artifact's releases.

v5.0.0

Changelog

See details of all c...

Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 23, 2026
@dependabot
dependabot Bot requested a review from mlevkov as a code owner September 23, 2026 16:24
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 23, 2026
@mlevkov

mlevkov commented Sep 23, 2026

Copy link
Copy Markdown
Owner

@dependabot rebase

@dependabot
ci(deps): bump the github-actions group across 1 directory with 10 up…
cb5c0c5 
…dates

Bumps the github-actions group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [dtolnay/rust-toolchain](https://github.com/dtolnay/rust-toolchain) | `fa04a1451ff1842e2626ccb99004d0195b455a88` | `02cb101ec7c40f2c49e1d9714d64511d8e1b74de` |
| [Swatinem/rust-cache](https://github.com/swatinem/rust-cache) | `e18b497796c12c097a38f9edb9d0641fb99eee32` | `f0d9c3887740aee45f6153b24b3a6b815192ec16` |
| [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.82.9` | `2.87.17` |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `4.6.0` | `7.1.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4` | `7` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `4` | `8` |
| [softprops/action-gh-release](https://github.com/softprops/action-gh-release) | `1` | `3` |
| [actions/upload-pages-artifact](https://github.com/actions/upload-pages-artifact) | `3` | `5` |
| [actions/deploy-pages](https://github.com/actions/deploy-pages) | `4` | `5` |



Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v7)

Updates `dtolnay/rust-toolchain` from fa04a1451ff1842e2626ccb99004d0195b455a88 to 02cb101ec7c40f2c49e1d9714d64511d8e1b74de
- [Release notes](https://github.com/dtolnay/rust-toolchain/releases)
- [Commits](dtolnay/rust-toolchain@fa04a14...02cb101)

Updates `Swatinem/rust-cache` from e18b497796c12c097a38f9edb9d0641fb99eee32 to f0d9c3887740aee45f6153b24b3a6b815192ec16
- [Release notes](https://github.com/swatinem/rust-cache/releases)
- [Changelog](https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md)
- [Commits](Swatinem/rust-cache@e18b497...f0d9c38)

Updates `taiki-e/install-action` from 2.82.9 to 2.87.17
- [Release notes](https://github.com/taiki-e/install-action/releases)
- [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md)
- [Commits](taiki-e/install-action@4684b84...94c31af)

Updates `codecov/codecov-action` from 4.6.0 to 7.1.1
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@b9fd7d1...303a32d)

Updates `actions/upload-artifact` from 4 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v4...v7)

Updates `actions/download-artifact` from 4 to 8
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v4...v8)

Updates `softprops/action-gh-release` from 1 to 3
- [Release notes](https://github.com/softprops/action-gh-release/releases)
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md)
- [Commits](softprops/action-gh-release@de2c0eb...efb3536)

Updates `actions/upload-pages-artifact` from 3 to 5
- [Release notes](https://github.com/actions/upload-pages-artifact/releases)
- [Commits](actions/upload-pages-artifact@v3...v5)

Updates `actions/deploy-pages` from 4 to 5
- [Release notes](https://github.com/actions/deploy-pages/releases)
- [Commits](actions/deploy-pages@v4...v5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/deploy-pages
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-pages-artifact
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: codecov/codecov-action
  dependency-version: 7.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: dtolnay/rust-toolchain
  dependency-version: 02cb101ec7c40f2c49e1d9714d64511d8e1b74de
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: softprops/action-gh-release
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: Swatinem/rust-cache
  dependency-version: f0d9c3887740aee45f6153b24b3a6b815192ec16
  dependency-type: direct:production
  dependency-group: github-actions
- dependency-name: taiki-e/install-action
  dependency-version: 2.87.17
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title ci(deps): bump the github-actions group with 10 updates ci(deps): bump the github-actions group across 1 directory with 10 updates Sep 23, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/github-actions-46be05a2e4 branch from f2c31ec to cb5c0c5 Compare September 23, 2026 20:08
mlevkov
mlevkov approved these changes Sep 23, 2026
View reviewed changes

@mlevkov mlevkov left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Triaged: 10 action bumps; third-party SHA pins verified against their upstream tags (rust-cache tracks master HEAD, 5 commits past v2.9.2, as the previous pin did). PR-path actions are exercised by this PR's CI on the final dependency state. The release-only actions (upload-artifact v7, download-artifact v8, action-gh-release v3.0.3, upload-pages-artifact v5, deploy-pages v5) are exercised by a v0.4.1-ci.1 pre-release tag right after this merge. The Codecov step here is uninformative: the repo has no CODECOV_TOKEN secret (pre-existing, same on main).

@mlevkov
mlevkov merged commit b7aba82 into main Sep 23, 2026
29 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-46be05a2e4 branch September 23, 2026 20:19
@mlevkov mlevkov mentioned this pull request Sep 23, 2026
Merged
7 tasks done
mlevkov added a commit that referenced this pull request Sep 23, 2026
@mlevkov
docs(tech-debt): correct the counts and wording review found
ee83355 
TD-2026-09-03 said 14 main push runs were rejected; there are 15 with a
retained log, all rejected. The count filtered on run conclusion and so
dropped 35910387482, cancelled by the concurrency group after its
upload step had run. Its title no longer says the upload "has never
authenticated", which reaches past the retained logs; it now says what
was measured.

Precision fixes: TD-2026-09-04 says the verifier fails on any ##[error]
line, which it does, notes that crates.io's 404 needs a User-Agent (403
without), and records the Verify Release workflow and the comments that
now name it. TD-2026-09-06 says Dependabot also rebases on a scheduled
run, and states that merge queues are for organization-owned
repositories only. TD-2026-07-02 points at the log's closing verdict
("No update possible for iggy 0.10.0"), says the MSRV raise also fires
TD-2026-09-02, and puts "by hand" in its Status line. TD-2026-07-07's
pointer says PR #37 already moved rust-cache as predicted, and no longer
calls v2.9.2 (released 2026-08-06) new.

TD-2026-09-05's second trigger, an upstream audit-check release, was an
event nothing here observes; it now binds to the next Dependabot PR that
moves either pin, with the upstream check done then.
mlevkov added a commit that referenced this pull request Sep 24, 2026
@mlevkov
docs(tech-debt): correct the counts and wording review found
e148351 
TD-2026-09-03 said 14 main push runs were rejected; there are 15 with a
retained log, all rejected. The count filtered on run conclusion and so
dropped 35910387482, cancelled by the concurrency group after its
upload step had run. Its title no longer says the upload "has never
authenticated", which reaches past the retained logs; it now says what
was measured.

Precision fixes: TD-2026-09-04 says the verifier fails on any ##[error]
line, which it does, notes that crates.io's 404 needs a User-Agent (403
without), and records the Verify Release workflow and the comments that
now name it. TD-2026-09-06 says Dependabot also rebases on a scheduled
run, and states that merge queues are for organization-owned
repositories only. TD-2026-07-02 points at the log's closing verdict
("No update possible for iggy 0.10.0"), says the MSRV raise also fires
TD-2026-09-02, and puts "by hand" in its Status line. TD-2026-07-07's
pointer says PR #37 already moved rust-cache as predicted, and no longer
calls v2.9.2 (released 2026-08-06) new.

TD-2026-09-05's second trigger, an upstream audit-check release, was an
event nothing here observes; it now binds to the next Dependabot PR that
moves either pin, with the upstream check done then.
mlevkov added a commit that referenced this pull request Sep 24, 2026
@mlevkov
docs: correct the restore steps and round 1's attribution
0566d29 
CONTRIBUTING called the re-run that failed with 'Multiple artifacts
named "github-pages"' v0.2.0's first. It was the second (attempt 3):
the first never reached a runner. The bullet no longer implies that the
first attempt's artifact stops counting once it expires, which is
untested, and says a re-run attempt runs Verify Release only if it
succeeds.

Round 1's corrected T5 attributed the .lock that only v0.4.1's Pages
artifact holds to the dependency bumps. Its cause is specific: the
upload-pages-artifact v5 that PR #37 brought leaves out hidden files
unless include-hidden-files is set, where v3 kept them.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mlevkov mlevkov mlevkov approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mlevkov