Skip to content

ci: bump the github-actions group with 5 updates - #88

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-c1f9dc46ff
Closed

ci: bump the github-actions group with 5 updates#88
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/github-actions-c1f9dc46ff

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the github-actions group with 5 updates:

Package From To
actions/checkout 4 7
actions/setup-go 5 7
swift-actions/setup-swift 2 3
actions/upload-artifact 6 7
actions/download-artifact 7 8

Updates actions/checkout from 4 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/setup-go from 5 to 7

Release notes

Sourced from actions/setup-go's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/setup-go@v6...v7.0.0

v6.5.0

What's Changed

Dependency update

New Contributors

Full Changelog: actions/setup-go@v6...v6.5.0

v6.4.0

What's Changed

Enhancement

Dependency update

Documentation update

New Contributors

Full Changelog: actions/setup-go@v6...v6.4.0

v6.3.0

What's Changed

Full Changelog: actions/setup-go@v6...v6.3.0

v6.2.0

What's Changed

... (truncated)

Commits

Updates swift-actions/setup-swift from 2 to 3

Release notes

Sourced from swift-actions/setup-swift's releases.

3.0.0 Beta 1

Beta 1 of using Swiftly to setup Swift

  • Now uses Swiftly to set up Swift
  • Added flag skip-verify-signature to disable GPG verification checks

Features

  • Setup Swift more Swiftly 🚀 (setup-swift 3.0) (#710) @​fwal

2.4.0

Features

Fixes

2.3.0

Features

2.2.0

2.1.0

Features

Dependencies

Commits

Updates actions/upload-artifact from 6 to 7

Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

Commits
  • 043fb46 Merge pull request #797 from actions/yacaovsnc/update-dependency
  • 634250c Include changes in typespec/ts-http-runtime 0.3.5
  • e454baa Readme: bump all the example versions to v7 (#796)
  • 74fad66 Update the readme with direct upload details (#795)
  • bbbca2d Support direct file uploads (#764)
  • 589182c Upgrade the module to ESM and bump dependencies (#762)
  • 47309c9 Merge pull request #754 from actions/Link-/add-proxy-integration-tests
  • 02a8460 Add proxy integration test
  • See full diff in compare view

Updates actions/download-artifact from 7 to 8

Release notes

Sourced from actions/download-artifact's releases.

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: actions/download-artifact@v7...v8.0.0

Commits
  • 3e5f45b Add regression tests for CJK characters (#471)
  • e6d03f6 Add a regression test for artifact name + content-type mismatches (#472)
  • 70fc10c Merge pull request #461 from actions/danwkennedy/digest-mismatch-behavior
  • f258da9 Add change docs
  • ccc058e Fix linting issues
  • bd7976b Add a setting to specify what to do on hash mismatch and default it to error
  • ac21fcf Merge pull request #460 from actions/danwkennedy/download-no-unzip
  • 15999bf Add note about package bumps
  • 974686e Bump the version to v8 and add release notes
  • fbe48b1 Update test names to make it clearer what they do
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
ci: bump the github-actions group with 5 updates
162ae8f 
Bumps the github-actions group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [actions/setup-go](https://github.com/actions/setup-go) | `5` | `7` |
| [swift-actions/setup-swift](https://github.com/swift-actions/setup-swift) | `2` | `3` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6` | `7` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `7` | `8` |


Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v7)

Updates `actions/setup-go` from 5 to 7
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v5...v7)

Updates `swift-actions/setup-swift` from 2 to 3
- [Release notes](https://github.com/swift-actions/setup-swift/releases)
- [Commits](swift-actions/setup-swift@v2...v3)

Updates `actions/upload-artifact` from 6 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@v6...v7)

Updates `actions/download-artifact` from 7 to 8
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@v7...v8)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/setup-go
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: swift-actions/setup-swift
  dependency-version: '3'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: '8'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 14, 2026
anderix added a commit that referenced this pull request Aug 14, 2026
@anderix @claude
ci: stop Dependabot bumping the actions cargo-dist owns
5d14055 
PR #88 grouped five action bumps and broke two jobs at once, which is what
surfaced this.

`release.yml` is generated by cargo-dist, and its `plan` job re-derives the
workflow and fails when the file on disk differs. Dependabot moved checkout,
upload-artifact and download-artifact inside it, so `plan` exited 255 with
"run 'dist init' to update the file" — every PR red and the next release
blocked until reverted. ved hit the same thing on 2026-05-14, and the recipe
in ~/notes/build_release_gotchas.md says to add these ignores from day one.
lux never got them, so the fleet rollout of that recipe missed this repo; the
other repos with a cargo-dist release are worth checking for the same gap.

The real update channel for those pins is bumping cargo-dist in
dist-workspace.toml and re-running `dist generate`, which moves all of them
together and keeps the file matching its generator.

The checkout ignore over-applies and the comment says so. ci.yml and
publish-crate.yml check out too, at v4 and v5, and Dependabot has no way to
scope an ignore to one file, so those stop being bumped as well. Taking that
trade deliberately: checkout is a runner utility holding nothing the workflow
does not already hold, and a stale one in two hand-written workflows is a
smaller problem than a release pipeline that fails validation weekly.

The second breakage in #88 was unrelated to dist. swift-actions/setup-swift
v3 fetches Swiftly and verifies its signature, and that verification fails on
the runner with "Can't check signature: No public key", taking the conformance
job's Swift leg with it. main ran the identical job green twenty minutes
later, so this is upstream and not ours. Held back at the major only, so v2.x
fixes still arrive, and the entry says to drop it once v3 installs cleanly.

Grouping is what made one PR carry both: five bumps together means two bad
members block three good ones. Keeping the group — the shared-lockfile rebase
cascade it prevents is the worse failure — and pinning the bad members
instead.

Author: David M. Anderson. Written by David M. Anderson with AI assistance.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer being updated by Dependabot, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 14, 2026
@dependabot
dependabot Bot deleted the dependabot/github_actions/github-actions-c1f9dc46ff branch August 14, 2026 19:53
@anderix

anderix commented Aug 14, 2026

Copy link
Copy Markdown
Owner

Closing unmerged. Two of the five bumps break a job, and the group makes it all-or-nothing.

actions/checkout 4→7, upload-artifact 6→7, download-artifact 7→8 break the release. release.yml is generated by cargo-dist, whose plan job re-derives the workflow and fails when the file on disk differs from what it would emit. plan exited 255 with run 'dist init' to update the file, which fails release validation on every PR and blocks the next tag. The update channel for those pins is bumping cargo-dist in dist-workspace.toml and re-running dist generate, which moves them together and keeps the file matching its generator.

swift-actions/setup-swift 2→3 breaks conformance. v3 fetches Swiftly and verifies its signature, and that verification dies on the runner with gpg: Can't check signature: No public key. Upstream, not ours — main ran the identical job green twenty minutes later.

setup-go 5→7 was the only bump here with nothing wrong with it.

Fixed at the source in 5d14055 rather than by reverting: dependabot.yml now ignores the three actions cargo-dist owns, and holds setup-swift at its current major while still accepting v2.x fixes. The checkout ignore over-applies to ci.yml and publish-crate.yml, since Dependabot cannot scope an ignore to one file — taken deliberately, and the reasoning is in the config comment.

Worth noting for the fleet: the recipe for this is in build_release_gotchas.md and says to add these ignores from day one. lux never had them, so the rollout missed this repo, and the other cargo-dist repos are worth a check.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@anderix