Skip to content

build(deps): bump the github-actions group with 3 updates #675

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

build(deps): bump the github-actions group with 3 updates #675

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,9 @@ jobs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: github/codeql-action/init@1ad29ea4a422cce9a242a9fae469541dcd08addc # v4
- uses: github/codeql-action/init@0911ee96d2d6c8def97122c36c5cadd93829a4b4 # v4
with:
languages: python
- uses: github/codeql-action/analyze@1ad29ea4a422cce9a242a9fae469541dcd08addc # v4
- uses: github/codeql-action/analyze@0911ee96d2d6c8def97122c36c5cadd93829a4b4 # v4
with:
category: /language:python
2 changes: 1 addition & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,7 +204,7 @@ jobs:
uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # release/v1

- name: Create GitHub Release
uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
uses: softprops/action-gh-release@8a0cd651e5b2365bd640854a3fa5dfc70e4875f3 # v3

@airmang airmang Nov 9, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P2] 이 pin 갱신과 릴리스 안전성 계약을 함께 동기화해 주세요. tests/test_release_workflow_safety.py:165의 EXPECTED_RELEASE_STEPS는 아직 softprops/action-gh-release@efb35369…를 요구하므로 새8a0cd651…를 사용하면 _workflow_safety_failures가 'release steps must match the exact order and actions'를 반환합니다. 정확한 head에서 pytest -q tests/test_release_workflow_safety.py → 2 failed,54 passed이며 실패는 test_public_legacy_cap_is_a_required_fail_closed_job(:440), test_core_release_build_inputs_and_remote_provenance_are_frozen(:881)입니다. 새 action의 공개 입력/동작을 검토한 후 기대 SHA만 일치시키고, 순서·권한·해시 검증 및 음성 테스트를 그대로 유지해 전체 CI를 다시 통과시켜 주세요. 이 가드를 제거하거나 우회해서는 안 됩니다.

with:
body_path: release_notes.md
draft: false
Expand Down
Loading