From dd89e66f4b757522e67fbe38f862ac7777505a61 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 29 Oct 2026 04:45:12 +0000 Subject: [PATCH] chore(deps): bump the github-actions group with 5 updates Bumps the github-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `6.1.0` | `7.0.1` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.2` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.3.0` | `8.0.2` | | [pullfrog/pullfrog](https://github.com/pullfrog/pullfrog) | `0.1.98` | `0.1.102` | | [actions/setup-node](https://github.com/actions/setup-node) | `6.5.0` | `7.1.0` | Updates `actions/checkout` from 6.1.0 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6.1.0...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `actions/upload-artifact` from 4.6.2 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...cf430e030ddbb5b0abf93d22962f4752f3646cd9) Updates `actions/download-artifact` from 4.3.0 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/d3f86a106a0bac45b974a628896c90dbdf5c8093...9000827ccba6bdab643e8b6fd33ac0654aef8333) Updates `pullfrog/pullfrog` from 0.1.98 to 0.1.102 - [Release notes](https://github.com/pullfrog/pullfrog/releases) - [Commits](https://github.com/pullfrog/pullfrog/compare/ad4283a862b8377cb525a0f5bf30f17c023b18ea...25a837a2b078177c3acdce790506d1fd1acedd82) Updates `actions/setup-node` from 6.5.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/249970729cb0ef3589644e2896645e5dc5ba9c38...949feb2413d6458794dcd2491c4babbbce0c15c1) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: pullfrog/pullfrog dependency-version: 0.1.102 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/bumpy-check.yaml | 2 +- .github/workflows/bumpy-comment.yaml | 2 +- .github/workflows/ci.yaml | 2 +- .github/workflows/pullfrog.yml | 4 ++-- .github/workflows/release.yaml | 8 ++++---- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/bumpy-check.yaml b/.github/workflows/bumpy-check.yaml index 5b173d8..78dc600 100644 --- a/.github/workflows/bumpy-check.yaml +++ b/.github/workflows/bumpy-check.yaml @@ -33,7 +33,7 @@ jobs: - run: bunx @varlock/bumpy ci check --emit-comment ./bumpy-comment env: GH_TOKEN: ${{ github.token }} - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 if: always() # upload even when the check fails — the comment explains why with: name: bumpy-comment diff --git a/.github/workflows/bumpy-comment.yaml b/.github/workflows/bumpy-comment.yaml index 1fb008f..dcc4164 100644 --- a/.github/workflows/bumpy-comment.yaml +++ b/.github/workflows/bumpy-comment.yaml @@ -30,7 +30,7 @@ jobs: - run: bun install # link the freshly-built CLI bin # Download to runner.temp (OUTSIDE the checkout) so the untrusted artifact can't # overwrite our trusted files. - - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 continue-on-error: true # the check may not have produced a comment with: name: bumpy-comment diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index e13b4e3..b1cc3f1 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -8,7 +8,7 @@ jobs: check: runs-on: ubuntu-latest steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 - run: bun install - run: cd packages/bumpy && bunx varlock load # need ENV types for tsdown config file diff --git a/.github/workflows/pullfrog.yml b/.github/workflows/pullfrog.yml index 42eab0a..1faa014 100644 --- a/.github/workflows/pullfrog.yml +++ b/.github/workflows/pullfrog.yml @@ -27,11 +27,11 @@ jobs: contents: read steps: - name: Checkout code - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 1 - name: Run agent - uses: pullfrog/pullfrog@ad4283a862b8377cb525a0f5bf30f17c023b18ea # v0.1.98 + uses: pullfrog/pullfrog@25a837a2b078177c3acdce790506d1fd1acedd82 # v0.1.102 with: prompt: ${{ inputs.prompt }} env: diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 3b85919..c7d9da2 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -26,7 +26,7 @@ jobs: mode: ${{ steps.plan.outputs.mode }} packages: ${{ steps.plan.outputs.packages }} steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 @@ -55,7 +55,7 @@ jobs: contents: write pull-requests: write steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 @@ -83,12 +83,12 @@ jobs: contents: write id-token: write # required for npm trusted publishing (OIDC) steps: - - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 # Node.js (npm) is needed for npm publish - - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: latest - run: npm install -g npm@latest # ensure npm >= 11.15.0 for staged publishing