Repository navigation
ci: update the pinned actions and keep dependencies current with Dependabot version updates #137
Description
Existing issue check
- I searched open and closed issues. repo: enforce the contribution rules with GitHub settings #123 set the GitHub policy (SHA-pinned GitHub-owned actions), and nothing keeps those pins or the package versions current.
Problem or outcome
- Pinned actions are behind (inventory 2026-10-15):
actions/checkoutv6.0.2 → v7.0.1 (3d3c42e5aac5ba805825da76410c181273ba90b1)actions/cachev5.0.4 → v6.1.0 (55cc8345863c7cc4c66a329aec7e433d2d1c52a9)actions/attest-build-provenancev4.1.1 → v4.2.2 (4d101475d8b20a2381f78447822ac1eab6504dd8)
- Version updates are not configured: Dependabot opens security PRs only (chore(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 in /web #132–chore(deps): bump cookie, @sveltejs/adapter-static and @sveltejs/kit in /web #134). The maintainer asked for latest versions where it makes sense, in general. Keeping that true needs a mechanism, not periodic sweeps.
Outcome
- The actions move to their latest releases, still SHA-pinned with version comments, after reading each major's release notes.
- A
.github/dependabot.ymlsets up grouped version updates fornpm(/web),cargo(/), andgithub-actions(/). The schedule and grouping keep the PR volume reviewable. Major updates are separated from minor and patch ones. CONTRIBUTING.mdstates the dependency policy in one or two lines.
Acceptance criteria
- Workflows use the latest action releases, SHA-pinned; the release workflow still produces attested assets (verified on the next release or a dry run).
-
dependabot.ymlvalidates, and Dependabot reports its configuration as active. - Full local proof and hosted checks pass.
Sequencing
This lands after #54, which also edits the workflows to pin a Node version for SvelteKit 3.
Execution record
- Authority: the maintainer's dependency policy and standing PR permission (2026-10-15).
- Next action: wait for web(deps): resolve SvelteKit cookie audit advisory #54, then branch from
main.
Activity
ci: update the pinned actions and keep dependencies current with Depe…
TusanHomichi commentedon Oct 15, 2026
Merged in #141 as
b2949fd12ad30ab9fc669d06ea4a3c647a444795(squash, single parent21fe68d). The tree3260cf5cis identical to the proven head683bc65.99156463….fmt-clippy-test,build-x86_64,build-aarch64(which exercise checkout v7, cache v6, and setup-node v7.1.0) and CodeQL passed. Codex found nothing.Still open, so this issue stays open:
attest-build-provenancev4.2.2. Its steps run only onv*tags. At the next release, rungh attestation verify <asset> -R FieldmouseWorks/consolebook --signer-workflow FieldmouseWorks/consolebook/.github/workflows/release.yml --source-ref refs/tags/vX.Y.Zon every asset, as on install: pin the one-line installer to a release and decide on archive signing #95, then close this.TusanHomichi commentedon Oct 15, 2026
attest-build-provenancev4.2.2 verified on its first real run: v0.3.0 (#146). All six assets verify strictly: signerrelease.yml, source refrefs/tags/v0.3.0, source digestdcdb9dc, GitHub-hosted runner, with negative controls.checkoutv7 andcachev6 have also run inpr-gateand the build jobs across PRs #141, #144, #145 and #147.Dependabot:
dependabot.ymlparses, and GitHub has raised no configuration error since it landed (#141). No version-update PR exists yet. That is expected, because every dependency was just moved to its latest release and the 7-day cooldown defers new ones. Its first grouped PR will confirm the configuration end to end. If a configuration error appears instead, this issue reopens.Closing: the pins are updated, attestation is verified, and the version-update configuration is in place.
TusanHomichi commentedon Oct 16, 2026
Follow-up for the remaining check:
.github/dependabot.ymlworks end to end.The first version-update jobs ran right after #141 merged, all successful:
The npm job's log shows the configuration was parsed and applied as written:
No PRs opened, because every dependency is current or still inside its cooldown. No config error was reported, so this issue stays closed. Future Dependabot PRs are handled as ordinary PRs.