chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1#297
chore(deps): bump softprops/action-gh-release from 2.5.0 to 2.6.1#297dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.5.0 to 2.6.1. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](softprops/action-gh-release@a06a81a...153bb8e) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 2.6.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
Greptile SummaryDependabot bumps
Confidence Score: 5/5
Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Tag Push / PR Merge] --> B{Which workflow?}
B -->|Tag push by non-bot| C[release-on-tag.yml]
B -->|Release PR merged| D[release.yml]
C --> E[Build & Test]
D --> F[Build & Test]
E --> G["softprops/action-gh-release@v2.6.1\n(was v2.5.0)"]
F --> H[Create & Push Tag]
H --> I["softprops/action-gh-release@v2.6.1\n(was v2.5.0)"]
G --> J[Publish to npm]
I --> K[Publish to npm]
Last reviewed commit: 756e8eb |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — straightforward Dependabot SHA pin bump for softprops/action-gh-release v2.5.0 → v2.6.1.
Extended reasoning...
Overview
This is a Dependabot-generated PR that updates the softprops/action-gh-release GitHub Action from v2.5.0 (SHA a06a81a) to v2.6.1 (SHA 153bb8e) in two workflow files: .github/workflows/release-on-tag.yml and .github/workflows/release.yml. Each file has exactly one line changed — the commit SHA pin. The # v2 version comment is preserved.
Security risks
None. The action references use full commit SHA pinning, which is the recommended practice for GitHub Actions supply chain security. The upstream release notes show only bug fixes and minor features (discussion category preservation, concurrent asset 404 recovery, previous_tag support). No new permissions or inputs are consumed by the workflows.
Level of scrutiny
Minimal scrutiny required. This is a mechanical, auto-generated dependency version bump with no logic changes, no new inputs, and no changes to workflow structure or permissions. The same pattern has been applied consistently to both files.
Other factors
No prior reviews or outstanding comments exist on this PR. No bugs were found by the automated bug hunting system. The upstream action is a well-known, widely-used GitHub Action with a clear changelog. The bump stays within the same major version (v2), so no breaking changes are expected.
Bumps softprops/action-gh-release from 2.5.0 to 2.6.1.
Release notes
Sourced from softprops/action-gh-release's releases.
... (truncated)
Changelog
Sourced from softprops/action-gh-release's changelog.
... (truncated)
Commits
153bb8erelease 2.6.1569deb8fix: preserve discussion category when publishing releases (#765)26e8ad2release 2.6.0b959f31fix: clarify immutable prerelease uploads (#763)8a8510eci: verify dist bundle freshness (#762)438c15ddocs: clarify working_directory input (#761)6ca3b5dfix: recover concurrent asset metadata 404s (#760)11f9176chore: add RELEASE.md1f3f350feat: add AGENTS.md37819cbdocs: clarify reused draft release behavior (#759)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)