ci: bump softprops/action-gh-release from 2.6.1 to 3.0.1 - #20
ci: bump softprops/action-gh-release from 2.6.1 to 3.0.1#20dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.6.1 to 3.0.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@153bb8e...718ea10) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
📝 WalkthroughWalkthroughThe ChangesRelease Workflow Action Pin
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Line 94: The trailing comment on the softprops/action-gh-release action line
currently says `# v2` but the pinned SHA has been updated to a newer version.
Update the inline comment from `# v2` to `# v3` (or the exact version that
corresponds to the pinned SHA) to maintain consistency and avoid future
confusion during dependency audits.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: ce889104-eec5-421f-a46c-5302d2d632d2
📒 Files selected for processing (1)
.github/workflows/release.yml
|
|
||
| - name: Create release | ||
| uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2 | ||
| uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v2 |
There was a problem hiding this comment.
Update the inline version label to match the new pinned release.
The SHA was upgraded for softprops/action-gh-release, but the trailing comment still says # v2. Please update it to # v3 (or exact version) to avoid future pin-audit confusion.
🧰 Tools
🪛 zizmor (1.25.2)
[info] 94-94: action functionality is already included by the runner (superfluous-actions): use gh release in a script step
(superfluous-actions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 94, The trailing comment on the
softprops/action-gh-release action line currently says `# v2` but the pinned SHA
has been updated to a newer version. Update the inline comment from `# v2` to `#
v3` (or the exact version that corresponds to the pinned SHA) to maintain
consistency and avoid future confusion during dependency audits.
Bumps softprops/action-gh-release from 2.6.1 to 3.0.1.
Release notes
Sourced from softprops/action-gh-release's releases.
Changelog
Sourced from softprops/action-gh-release's changelog.
... (truncated)
Commits
718ea10release 3.0.1f1a938bchore(deps): bump esbuild from 0.28.0 to 0.28.1 (#802)0066eadchore(deps): bump vite from 8.0.14 to 8.0.16 (#806)dc643cachore(deps): bump the npm group with 3 updates (#805)85ee99bchore(deps): bump actions/checkout in the github-actions group (#804)9ed3cf9chore(deps): bump the npm group with 2 updates (#800)3efcac8chore(deps): bump the npm group with 3 updates (#798)05d6b91chore(deps): bump brace-expansion from 5.0.5 to 5.0.6 (#797)403a524chore(deps): bump@types/nodefrom 24.12.2 to 24.12.3 in the npm group (#796)437e073chore(deps): bump the npm group with 4 updates (#792)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit