chore(deps)!: Update GitHub Actions (major) - #53
Conversation
|
Warning Review limit reached
Next review available in: 8 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (9)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
There was a problem hiding this comment.
Pull request overview
Updates the repository’s GitHub Actions workflows to use actions/checkout v7 (pinned by commit SHA) in order to keep CI/security/release automation current.
Changes:
- Bumped
actions/checkoutfrom v6.x to v7 across all workflows that perform a checkout. - Updated the pinned checkout digest consistently across CI, security, release, and provenance workflows.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/slsa-provenance.yml | Update checkout action pin to v7 for provenance build job. |
| .github/workflows/security-analysis.yml | Update checkout action pin to v7 for security scan job. |
| .github/workflows/reuse.yml | Update checkout action pin to v7 for REUSE compliance job. |
| .github/workflows/release.yml | Update checkout action pin to v7 for test + release jobs. |
| .github/workflows/publish-artifact-registry.yml | Update checkout action pin to v7 for publish workflow. |
| .github/workflows/pr-validation.yml | Update checkout action pin to v7 for dead-code job. |
| .github/workflows/dependency-review.yml | Update checkout action pin to v7 for dependency review job. |
| .github/workflows/codeql.yml | Update checkout action pin to v7 for CodeQL analysis job. |
| .github/workflows/ci.yml | Update checkout action pin to v7 across CI jobs. |
| - name: Checkout repository | ||
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 |
51480f3 to
0d5a5db
Compare
0d5a5db to
fa229a4
Compare
fa229a4 to
7d3002c
Compare
williaby
changed the title
|
Summary
Why
Scheduled patch update, bug fixes and security patches with no API changes.
Changes
This PR contains the following updates:
v6.0.3→v7.0.1v6→v7v6.2.0→v7.0.0v8.2.0→v9.0.0Impact
Acceptance Criteria
Testing
Notes
Release Notes
actions/checkout (actions/checkout)
v7.0.1Compare Source
v7.0.0Compare Source
v7Compare Source
v6.1.0Compare Source
What's Changed
allow-unsafe-pr-checkoutto v6 by @aiqiaoy in #2500https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change
Full Changelog: actions/checkout@v6.0.3...v6.1.0
actions/setup-python (actions/setup-python)
v7.0.0Compare Source
What's Changed
Enhancements
Bug Fix
Dependency Upgrade
New Contributors
Full Changelog: actions/setup-python@v6...v7.0.0
v7Compare Source
v6.3.0Compare Source
What's Changed
Enhancement
Dependency update
Documentation
New Contributors
Full Changelog: actions/setup-python@v6.2.0...v6.3.0
astral-sh/setup-uv (astral-sh/setup-uv)
v9.0.0: 🌈 Changeprune-cachedefault tofalseCompare Source
Changes
This release disables the default cache cache pruning to ease the load on the PyPi infrastructure.
Since users might experience more GitHub Actions cache usage which might result in higher costs this is marked as a breaking change. To read more on why we did this (now) you can read the detailed analysis and reasoning in #967
Besides this big breaking change we also have a small bugfix while building caches for linux distributions that behave a big different than the "big ones" and a speed up in version resolution by only reading the version manifest until a matching version is found saving runtime and network bandwith.
🚨 Breaking changes
prune-cachedefault tofalse@charliermarsh (#967)🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v8.3.2: 🌈 update known checksums for 0.11.28Compare Source
Changes
Just a maintenance release
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
v8.3.1: 🌈 update known checksums for 0.11.27Compare Source
Changes
Just a maintenance release
🧰 Maintenance
📚 Documentation
v8.3.0: 🌈 Support uv.lock as a version-file sourceCompare Source
Changes
Thanks to @somaz94 you can now use the pinned version of uv itself in
uv.lock. It gets picked up automatically.If you have pinned another version of uv in your
uv.lockyou can use the inputsversionorversion-sourceto override this.🐛 Bug fixes
🚀 Enhancements
🧰 Maintenance
📚 Documentation
⬆️ Dependency updates
Configuration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate.