Skip to content

chore(deps): bump the actions group across 2 directories with 2 updates - #113

Merged
IvanWng97 merged 2 commits into
mainfrom
dependabot/github_actions/actions-d694d73197
Nov 10, 2026
Merged

chore(deps): bump the actions group across 2 directories with 2 updates#113
IvanWng97 merged 2 commits into
mainfrom
dependabot/github_actions/actions-d694d73197

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the actions group with 1 update in the / directory: release-plz/action.
Bumps the actions group with 1 update in the /.github/actions/setup-tools directory: jdx/mise-action.

Updates release-plz/action from 0.5.147 to 0.5.148

Release notes

Sourced from release-plz/action's releases.

v0.5.148

What's Changed

Full Changelog: release-plz/action@v0.5.147...v0.5.148

Commits
  • 66b324f Update to 0.4.3 (#594)
  • f5cc4d9 chore(deps): lock file maintenance (#593)
  • 1269ff5 chore(deps): update dependency taiki-e/install-action to v2.89.0 (#592)
  • 31331ef chore(deps): update dependency cargo-bins/cargo-binstall to v1.26.2 (#591)
  • 7fa34b0 chore(deps): update dependency taiki-e/install-action to v2.88.1 (#590)
  • f538006 chore(deps): update dependency taiki-e/install-action to v2.88.0 (#589)
  • 8b6afa3 chore(deps): update dependency taiki-e/install-action to v2.87.33 (#588)
  • See full diff in compare view

Updates jdx/mise-action from 5.2.4 to 5.2.6

Release notes

Sourced from jdx/mise-action's releases.

v5.2.6: Fix step hanging after a failed cache restore

The action now exits as soon as its work is done. Before this release, a cache restore that failed during the download could leave the step running for up to ten minutes after setup had finished.

Fixed

  • A failed cache restore no longer leaves the step hanging. If the mise cache download failed partway through, for example with getaddrinfo EAI_AGAIN, the action logged a warning, installed the tools and saved the cache, then stopped producing output. The step stayed in progress until the job was cancelled or a timer inside @actions/cacheactions/toolkit#2470Error objects now mark the step as failed with their message. Before, they caused an unhandled rejection. (#718 by @​jdx and @​kjanat, fixes #717)

Full Changelog: jdx/mise-action@v5.2.5...v5.2.6

v5.2.5: Bundled packslip verifier updated to 1.11.0; README examples use v5

This release updates the packslip library that the action uses to verify downloaded mise releases, and updates the README examples to use the current major versions.

Changed

  • packslip updated from 1.8.0 to 1.11.0. The action uses packslip to check a downloaded mise binary against the signed packslip.sigstore.json that ships with mise releases from 2026.9.3 onward. The new version runs extra checks on the signed statement: the identity it declares must match the certificate that signed it, and the certificate must belong to the github.com/jdx/mise repository. GitHub and GitLab repository names now match regardless of letter case. The action still asks for the same identity, issuer and tag as before, and there are no new inputs. (#715)
  • The README examples now use jdx/mise-action@v5 and actions/checkout@v7. (#710 by @​deining)

Full Changelog: jdx/mise-action@v5.2.4...v5.2.5

Changelog

Sourced from jdx/mise-action's changelog.

Changelog

5.2.7 - 2026-11-06

🐛 Bug Fixes

  • retry transient download failures with backoff and report the HTTP status (#722) by @​jdx in #722

5.2.6 - 2026-11-02

🐛 Bug Fixes

  • exit after run and post so a failed cache restore can't hang the step (#718) by @​jdx in #718

5.2.5 - 2026-10-31

🔍 Other Changes

5.2.4 - 2026-10-27

🐛 Bug Fixes

  • (cache) reuse signed checksums saved with a cached mise (#708) by @​jdx in #708

5.2.3 - 2026-10-24

🐛 Bug Fixes

  • (cache) hash mise config files without walking the workspace (#703) by @​jdx in #703

5.2.2 - 2026-10-21

🐛 Bug Fixes

New Contributors

5.2.1 - 2026-10-19

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the actions group across 2 directories with 2 updates
077e31a 
Bumps the actions group with 1 update in the / directory: [release-plz/action](https://github.com/release-plz/action).
Bumps the actions group with 1 update in the /.github/actions/setup-tools directory: [jdx/mise-action](https://github.com/jdx/mise-action).


Updates `release-plz/action` from 0.5.147 to 0.5.148
- [Release notes](https://github.com/release-plz/action/releases)
- [Commits](release-plz/action@f67a7e7...66b324f)

Updates `jdx/mise-action` from 5.2.4 to 5.2.6
- [Release notes](https://github.com/jdx/mise-action/releases)
- [Changelog](https://github.com/jdx/mise-action/blob/main/CHANGELOG.md)
- [Commits](jdx/mise-action@6be3c7e...f5be966)

---
updated-dependencies:
- dependency-name: release-plz/action
  dependency-version: 0.5.148
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: jdx/mise-action
  dependency-version: 5.2.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 9, 2026
@coderabbitai

coderabbitai Bot commented Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Explain Change →

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

  • Source mode: Auto
  • Repository: pixtuoid/lofi
  • Branch: main
  • File: .coderabbit.yaml
  • Commit: 78f1cd7
  • Layers: Repository YAML
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 2f4b3e46-ddb4-4379-b687-1867e92a7176

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review

No actionable comments were generated in the recent review.

Walkthrough

The setup-tools action now pins mise v5.2.6. The release-plz workflow now uses v0.5.148 for both its release-pr and release steps.

Changes: GitHub Actions Pin Updates

Layer / File(s) Summary
Update pinned action versions
.github/actions/setup-tools/action.yml, .github/workflows/release-plz.yml		 The mise action pin changes to v5.2.6. Both release-plz action pins change to v0.5.148.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Possibly related PRs

  • pixtuoid/lofi#52: Sets the release-plz action pin to v0.5.147, which this change updates to v0.5.148.

Suggested reviewers: ivanwng97

Merge Risk: Minimal · previous review 077e3

The action updates have no identified merge-blocking issue. No test results were reported.

Security architecture risk: Low · up to 077e3

The updates preserve configured permissions, secret mappings, and release gates. No introduced security issue was demonstrated. Residual uncertainty remains because the new third-party implementations and external publishing authorization were not independently verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — The dependency trust surface includes CI runner execution, repository release operations, and potential package publishing through OIDC. The updated mise action also executes in the existing coverage job with id-token:write. The maximum reach of RELEASE_PLZ_TOKEN and externally accepted OIDC identities cannot be bounded from these workflow declarations alone.

Trust Boundaries and Controls

  • observed — The repository-local controls separating ordinary CI from release authority remain unchanged. CI uses push and pull_request triggers; privileged release execution is separately gated by repository identity, main-branch release-PR dispatch or merged-release detection, and the release environment declaration. The environment declaration does not itself demonstrate approval protection or external publisher authorization.
Pre-merge checks: Passed 5

Check name Status Explanation
Title check Passed The title accurately identifies a dependency update across two directories and matches the changeset.
Description check Passed The description clearly explains both GitHub Actions updates and includes relevant release notes.
Docstring Coverage Passed No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Finishing Touches

Generate unit tests (beta)

  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

Recent review info

Run configuration

  • Source mode: Auto
  • Repository: pixtuoid/lofi
  • Branch: main
  • File: .coderabbit.yaml
  • Commit: b369497
  • Layers: Repository YAML
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: d8385c76-67b5-425e-a722-38e489ff0bb3
Commits

Reviewing files that changed from the base of the PR and between b369497 and 077e31a.

Files selected for processing: 2

  • .github/actions/setup-tools/action.yml
  • .github/workflows/release-plz.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

@mergify

mergify Bot commented Nov 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.

@codecov

codecov Bot commented Nov 9, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@IvanWng97
IvanWng97 merged commit d75649a into main Nov 10, 2026
21 checks passed
@IvanWng97
IvanWng97 deleted the dependabot/github_actions/actions-d694d73197 branch November 10, 2026 08:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@IvanWng97