Roll up dependabot updates and batch GitHub Actions

[ben-vaughan-nttd]

Summary

• Rolls up open dependabot PRs Bump actions/checkout from 6 to 7 #27, Bump actions/cache from 5 to 6 #28, Bump the go-modules group across 1 directory with 2 updates #30, Bump actions/setup-go from 6 to 7 #31, and Bump google.golang.org/grpc from 1.81.1 to 1.82.1 in the go-modules-security group across 1 directory #32 into a single update
• Bumps Go toolchain to 1.26.5 and refreshes direct/indirect module dependencies (including gosec, golang.org/x/vuln, and google.golang.org/grpc)
• Updates GitHub Actions to actions/checkout@v7, actions/setup-go@v7, and actions/cache@v6
• Configures dependabot to batch GitHub Actions version updates into one weekly PR

Supersedes

• Bump actions/checkout from 6 to 7 #27 Bump actions/checkout from 6 to 7
• Bump actions/cache from 5 to 6 #28 Bump actions/cache from 5 to 6
• Bump the go-modules group across 1 directory with 2 updates #30 Bump the go-modules group with 2 updates
• Bump actions/setup-go from 6 to 7 #31 Bump actions/setup-go from 6 to 7
• Bump google.golang.org/grpc from 1.81.1 to 1.82.1 in the go-modules-security group across 1 directory #32 Bump google.golang.org/grpc in the go-modules-security group

Test plan

• go test -race ./...
• go build ./...
• CI pipeline (lint, security, build matrix)

Made with Cursor

[aarti-joshi-nttd]

PR Review: Roll up dependabot updates and batch GitHub Actions (#33)

Repo: launchbynttdata/launch-ado-automatic-versioner
Author: ben-vaughan-nttd
Branch: chore/rollup-dependabot-updates → main

---

What This PR Does Well

• Consolidates 5 open dependabot PRs into a single, easier-to-review update, reducing churn.
• Adds a github-actions group to .github/dependabot.yml so future Actions version bumps are batched weekly instead of arriving as separate PRs — good maintenance hygiene.
• All CI checks pass (build matrix, go mod tidy check, lint, security/gosec, vulnerability check, and tests), giving confidence the toolchain/dependency bump is safe.
• Security-relevant tooling (gosec, golang.org/x/vuln) is bumped to newer versions, keeping the security scanning pipeline current.

---

Fixes Required

Blocking

No blocking issues found.

Non-Blocking

Suggestions and improvements — address at your discretion.

#	File & Line	Issue
1	go.sum (davecgh/go-spew, pmezard/go-difflib entries)	The rollup pulls in github.com/davecgh/go-spew and github.com/pmezard/go-difflib via untagged pseudo-versions (v1.1.2-0.20180830191138-..., v1.0.1-0.20181226105442-...) instead of the previously-pinned stable tags. This is a side effect of MVS resolution from another updated indirect dependency rather than an intentional bump — worth a quick sanity check that no replace/vendoring assumptions rely on the tagged versions, though risk is low since these are test-only utility packages.
2	.tool-versions	Whitespace-only reformatting of the pre-commit line (alignment changed) is unrelated to the version bump; harmless, but could be split out or mentioned in the summary to avoid a confusing diff line.

---

Overall Recommendation: approve

This is a low-risk, mechanical dependency/tooling rollup with green CI across build, lint, security, vulnerability, and test jobs. No functional code changes are introduced. The two non-blocking notes are informational only.

[aarti-joshi-nttd]

Approving — this is a clean, mechanical rollup of dependabot updates (Go toolchain, GitHub Actions, module deps) with no functional/logic code touched. All CI checks pass. See detailed review comment above for two minor non-blocking notes (go.sum pseudo-versions, unrelated whitespace realignment in .tool-versions).

[rabindra-yadav-nttd]

Approving

I reviewed this dependency and workflow rollup and found no blocking issues.

Summary

• Consolidates Dependabot PRs #27, #28, #30, #31, and #32 into one coordinated update.
• Updates the Go toolchain consistently from 1.26.4 to 1.26.5 in both go.mod and .tool-versions.
• Updates actions/checkout to v7, actions/setup-go to v7, and actions/cache to v6 across CI and release workflows.
• Updates security-related tooling, including gosec, golang.org/x/vuln, and google.golang.org/grpc.
• Adds weekly grouping for future GitHub Actions Dependabot updates, which should reduce PR noise.
• Contains no application or versioning-logic changes.
• All 10 CI checks pass for commit 6c12013, including tests, race detection, lint, security, vulnerability scanning, module-tidiness validation, and the cross-platform build matrix.

Non-Blocking Suggestions

• The dependency refresh introduces pseudo-versions for go-spew and go-difflib. These appear to be normal minimal-version-selection results and CI is green, but they are worth retaining awareness of during future dependency updates.
• For stronger workflow supply-chain controls, consider pinning third-party GitHub Actions to full commit SHAs if that is part of the organization’s security policy. This is not introduced as a new concern by this PR because the workflows already used major-version tags.

Overall, this is a clean dependency and automation update with comprehensive green CI and no functional regressions identified. It is safe to merge.