chore(deps): bump the github-actions group across 1 directory with 5 updates#1645
chore(deps): bump the github-actions group across 1 directory with 5 updates#1645dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — routine Dependabot group bump for 5 GitHub Actions; only nit is the stale # v5.0.4 comment on actions/cache (called out inline).
Extended reasoning...
Overview
Dependabot grouped bump of 5 GitHub Actions across .github/workflows/{ci,codeql,dependabot-merge,release}.yml:
astral-sh/setup-uv8.0.0 → 8.1.0actions/cache5.0.4 → 5.0.5github/codeql-action4.35.1 → 4.35.2dependabot/fetch-metadata3.0.0 → 3.1.0slackapi/slack-github-action3.0.1 → 3.0.2
All bumps are patch or minor, all are pinned by immutable SHA, and the diff only changes the SHA + version-comment lines (no behavioral workflow changes).
Security risks
Low risk. All actions remain SHA-pinned per the project policy in commit d5ce2d2. The new SHAs match the Dependabot-claimed tag commits, the slack/codeql/release-uv steps continue to gate on trusted secrets and success()/failure() conditions, and the cache-poisoning zizmor exception remains intentionally scoped to CI-only artifacts. No permissions, secrets, or job triggers were modified.
Level of scrutiny
Low — this is a Dependabot dependency-only PR touching CI configuration with no production code path. The repo has clearly codified its action-pinning policy and an auto-merge workflow for patch-level dependabot updates, signaling these are intended to flow through with minimal review.
Other factors
The bug-hunting agent flagged exactly one nit: the actions/cache bump updated the SHA but Dependabot left the trailing # v5.0.4 comment stale. Worth fixing for hygiene, but not approval-blocking — the executed SHA is correct and the inline comment communicates the fix to the author. No outstanding human reviewer comments to respond to.
| python-version: "3.13" | ||
| enable-cache: true # zizmor: ignore[cache-poisoning] CI-only, no artifacts published | ||
| - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 # zizmor: ignore[cache-poisoning] | ||
| - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.4 # zizmor: ignore[cache-poisoning] |
There was a problem hiding this comment.
🟡 The actions/cache SHA on this line was bumped from 668228422ae6a00e4ad889ee87cd7109ec5666a7 (v5.0.4) to 27d5ce7f107fe9357f9df03efb73ab90386fccae (v5.0.5), but the trailing version comment was left at # v5.0.4. The other four dependency bumps in this PR correctly updated their comments — only this one was missed by Dependabot. Update the comment to # v5.0.5 so the human-readable annotation matches the pinned SHA, per commit d5ce2d2 ("chore(ci): pin action version comments to immutable patch tags").
Extended reasoning...
What's wrong
At .github/workflows/ci.yml:49, the diff updates only the SHA half of the pinned-action reference and leaves the comment stale:
- - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 # zizmor: ignore[cache-poisoning]
+ - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.4 # zizmor: ignore[cache-poisoning]The new SHA 27d5ce7f107fe9357f9df03efb73ab90386fccae is the merge commit for actions/cache#1747 ("Update ts-http-runtime dependency"), which is the sole change in the v5.0.5 release. The PR's own description table also explicitly lists actions/cache moving from 5.0.4 → 5.0.5. So the SHA is v5.0.5 but the comment still says v5.0.4.
Step-by-step proof
- The PR description's update table reads:
actions/cache | 5.0.4 | 5.0.5. - The new SHA in the diff is
27d5ce7f107fe9357f9df03efb73ab90386fccae. - Per the v5.0.5 release notes, that SHA is the v5.0.5 tag's merge commit ("Merge pull request #1747 from actions/yacaovsnc/update-dependency").
- The trailing comment in the diff still reads
# v5.0.4. - Therefore the SHA-to-comment mapping is now incorrect: comment claims v5.0.4, SHA actually points to v5.0.5.
Why this matters
Pinning by SHA with a human-readable version comment is only useful if the comment is truthful — that's the whole point of the policy added in commit d5ce2d2 ("chore(ci): pin action version comments to immutable patch tags"). A reviewer or auditor scanning workflows for "what version of actions/cache are we on?" would read v5.0.4 and be wrong. The other four bumps in this same PR (setup-uv, codeql-action/init, codeql-action/analyze, fetch-metadata, slack-github-action) all had their comments correctly updated; only actions/cache was missed. This is purely a Dependabot diff inconsistency.
Impact
No runtime effect — the pinned SHA is what's actually executed. This is strictly a documentation/annotation correctness issue. However, it directly contradicts the project's recently-codified pinning policy, so it should be corrected before merge.
Fix
Change line 49 from:
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.4 # zizmor: ignore[cache-poisoning]to:
- uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 # zizmor: ignore[cache-poisoning]…updates Bumps the github-actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `8.0.0` | `8.1.0` | | [actions/cache](https://github.com/actions/cache) | `5.0.4` | `5.0.5` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.35.1` | `4.35.2` | | [dependabot/fetch-metadata](https://github.com/dependabot/fetch-metadata) | `3.0.0` | `3.1.0` | | [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action) | `3.0.1` | `3.0.2` | Updates `astral-sh/setup-uv` from 8.0.0 to 8.1.0 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@cec2083...0880764) Updates `actions/cache` from 5.0.4 to 5.0.5 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@6682284...27d5ce7) Updates `github/codeql-action` from 4.35.1 to 4.35.2 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c10b806...95e58e9) Updates `dependabot/fetch-metadata` from 3.0.0 to 3.1.0 - [Release notes](https://github.com/dependabot/fetch-metadata/releases) - [Commits](dependabot/fetch-metadata@ffa630c...25dd0e3) Updates `slackapi/slack-github-action` from 3.0.1 to 3.0.2 - [Release notes](https://github.com/slackapi/slack-github-action/releases) - [Changelog](https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md) - [Commits](slackapi/slack-github-action@af78098...03ea543) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: 8.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: dependabot/fetch-metadata dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: slackapi/slack-github-action dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/github-actions-f85b4cc3e7
branch
from
78c1cbd to
aa46aca
Compare
Bumps the github-actions group with 5 updates in the / directory:
8.0.08.1.05.0.45.0.54.35.14.35.23.0.03.1.03.0.13.0.2Updates
astral-sh/setup-uvfrom 8.0.0 to 8.1.0Release notes
Sourced from astral-sh/setup-uv's releases.
Commits
0880764fix: grant contents:write to validate-release job (#860)717d6abAdd a release-gate step to the release workflow (#859)5a911ebDraft commitish releases (#858)080c31eAdd action-types.yml to instructions (#857)b3e97d2Add input no-project in combination with activate-environment (#856)7dd591dchore(deps): bump release-drafter/release-drafter from 7.1.1 to 7.2.0 (#855)1541b77chore: update known checksums for 0.11.7 (#853)cdfb2eeRefactor version resolving (#852)cb84d12chore: update known checksums for 0.11.6 (#850)1912cc6chore: update known checksums for 0.11.5 (#845)Updates
actions/cachefrom 5.0.4 to 5.0.5Release notes
Sourced from actions/cache's releases.
Changelog
Sourced from actions/cache's changelog.
... (truncated)
Commits
27d5ce7Merge pull request #1747 from actions/yacaovsnc/update-dependencyf280785licensed changes619aeb1npm run build generated dist filesbcf16c2Update ts-http-runtime to 0.3.5Updates
github/codeql-actionfrom 4.35.1 to 4.35.2Release notes
Sourced from github/codeql-action's releases.
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
95e58e9Merge pull request #3824 from github/update-v4.35.2-d2e135a736f31bfeUpdate changelog for v4.35.2d2e135aMerge pull request #3823 from github/update-bundle/codeql-bundle-v2.25.260abb65Add changelog note5a0a562Update default bundle to codeql-bundle-v2.25.26521697Merge pull request #3820 from github/dependabot/github_actions/dot-github/wor...3c45af2Merge pull request #3821 from github/dependabot/npm_and_yarn/npm-minor-345b93...f1c3393Rebuild1024fc4Rebuild9dd4cfeBump the npm-minor group across 1 directory with 6 updatesUpdates
dependabot/fetch-metadatafrom 3.0.0 to 3.1.0Release notes
Sourced from dependabot/fetch-metadata's releases.
Commits
25dd0e3v3.1.0 (#692)e073f50Merge pull request #705 from dependabot/dependabot/npm_and_yarn/hono-4.12.140670e16build(deps-dev): bump hono from 4.12.12 to 4.12.147a7fe10Merge pull request #702 from dependabot/dependabot/npm_and_yarn/dependencies-...5168191Updating dist build23882e1build(deps): bump@actions/githubin the dependencies group1072469Merge pull request #701 from dependabot/dependabot/github_actions/actions/cre...43f8a00build(deps): bump actions/create-github-app-token from 3.0.0 to 3.1.1b4d904aMerge pull request #703 from dependabot/dependabot/npm_and_yarn/globals-17.5.0c8046bbbuild(deps-dev): bump globals from 17.4.0 to 17.5.0Updates
slackapi/slack-github-actionfrom 3.0.1 to 3.0.2Release notes
Sourced from slackapi/slack-github-action's releases.
Changelog
Sourced from slackapi/slack-github-action's changelog.
Commits
03ea543chore: release90fee45chore: release (#593)b0fbce7ci: send release announcements on publish (#594)0b9c067build: automate release packaging and version bumps with changesets (#592)dd817b0docs: update broken hyperlinks to docs (#591)7ce931ddocs: streamlines doc structure (#590)093434fbuild(deps): bump follow-redirects from 1.15.11 to 1.16.0 (#589)1f09fc7build(deps-dev): bump typescript from 5.9.3 to 6.0.2 (#584)79529d7build(deps): bump axios from 1.14.0 to 1.15.0 (#588)4414b7fbuild(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0 (#581)