From 6a2929a6a51cdca6bd1ab3725b57f116d51f7a39 Mon Sep 17 00:00:00 2001 From: Malcolm Fell Date: Tue, 28 Jul 2026 09:37:11 +1200 Subject: [PATCH] Bump actions/checkout to v7 and add Dependabot for actions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both workflows pinned actions/checkout@v4, three majors behind the latest (v7.0.1). Bump ci.yml and release.yml to @v7 — a drop-in with no input changes. A re-scan confirms checkout is the only action in either workflow. Add .github/dependabot.yml (github-actions, weekly) so future bumps are raised automatically and only merge once CI proves them green. Closes #3 --- .github/dependabot.yml | 9 +++++++++ .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 2 +- 3 files changed, 11 insertions(+), 2 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..e3fddf3 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,9 @@ +# Keep GitHub Actions current: Dependabot opens a PR when a newer version of +# any action used in .github/workflows/ is available. CI runs on those PRs, so +# a bump only merges once it's proven green. +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index db12795..bfb083f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -21,7 +21,7 @@ jobs: runs-on: macos-26 steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Show toolchain run: swift --version diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5cd9ec3..0f83451 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,7 +19,7 @@ jobs: runs-on: macos-26 steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Show toolchain run: |