ci: update GitHub Actions and add Dependabot#5
Conversation
There was a problem hiding this comment.
Pull request overview
Updates CI/release/docs GitHub Actions references and introduces a centralized Dependabot configuration to standardize automated dependency maintenance (GitHub Actions + Python) across the repository.
Changes:
- Bump versions for several GitHub Actions used in CI, docs deploy, and release workflows.
- Add
.github/dependabot.ymlwith weekly grouped updates forgithub-actionsandpip.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
.github/workflows/release.yml |
Updates action versions for build artifact upload/download and PyPI publish/release steps. |
.github/workflows/docs.yml |
Updates checkout/uv setup actions and bumps the deploy-to-website action version. |
.github/workflows/ci.yml |
Updates checkout/uv setup and artifact upload action versions in CI jobs. |
.github/dependabot.yml |
Adds weekly Dependabot updates/groups for GitHub Actions and Python (pip). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
|
||
| - name: Publish to PyPI | ||
| uses: pypa/gh-action-pypi-publish@release/v1 | ||
| uses: pypa/gh-action-pypi-publish@v1.14.0 |
There was a problem hiding this comment.
For release publishing, consider pinning pypa/gh-action-pypi-publish to a full commit SHA instead of a version tag. This reduces the blast radius of a compromised/moved tag for a workflow that has permission to publish artifacts to PyPI.
| uses: pypa/gh-action-pypi-publish@v1.14.0 | |
| uses: pypa/gh-action-pypi-publish@<FULL_40_CHARACTER_COMMIT_SHA_FOR_V1_14_0> # v1.14.0 |
|
|
||
| - package-ecosystem: "pip" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "weekly" | ||
| day: "monday" | ||
| time: "06:15" | ||
| timezone: "America/New_York" | ||
| open-pull-requests-limit: 10 | ||
| labels: | ||
| - "dependencies" | ||
| - "python" | ||
| commit-message: | ||
| prefix: "deps" | ||
| groups: | ||
| python-dependencies: | ||
| patterns: | ||
| - "*" |
There was a problem hiding this comment.
Dependabot's "pip" ecosystem can update pyproject.toml, but it will not update the committed uv.lock, which can lead to PRs that change version constraints without updating the lockfile (and potentially to CI resolving different deps than what’s committed). Consider either disabling the pip updater, or adding automation/CI checks that regenerate & commit uv.lock as part of dependency-update PRs so the lockfile stays in sync.
| - package-ecosystem: "pip" | |
| directory: "/" | |
| schedule: | |
| interval: "weekly" | |
| day: "monday" | |
| time: "06:15" | |
| timezone: "America/New_York" | |
| open-pull-requests-limit: 10 | |
| labels: | |
| - "dependencies" | |
| - "python" | |
| commit-message: | |
| prefix: "deps" | |
| groups: | |
| python-dependencies: | |
| patterns: | |
| - "*" |
| version: 2 | ||
| updates: | ||
| - package-ecosystem: "github-actions" |
There was a problem hiding this comment.
PR description mentions updating codecov/codecov-action “where used”, but there’s no workflow/config in this repo referencing that action (searching the repo turns up no matches). Please either remove that bullet from the PR description or include the missing change if it was intended.
|
|
||
| - name: Deploy to website repo | ||
| uses: cpina/github-action-push-to-another-repository@v1.7.2 | ||
| uses: cpina/github-action-push-to-another-repository@v1.7.3 |
There was a problem hiding this comment.
This workflow uses a third-party action that can push to another repository using an SSH deploy key. For supply-chain hardening, consider pinning cpina/github-action-push-to-another-repository to a full commit SHA (and optionally using GitHub’s allow-listing/pinning guidance) rather than a mutable tag, to reduce the risk of upstream tag compromise.
| uses: cpina/github-action-push-to-another-repository@v1.7.3 | |
| # Pin to the full commit SHA for the v1.7.3 release to avoid mutable tag risk. | |
| uses: cpina/github-action-push-to-another-repository@<FULL_40_CHARACTER_COMMIT_SHA_FOR_V1.7.3> |
Summary
Updated actions
Validation