Repository navigation
chore(ci): one pass over action pins instead of four dependency PRs - #292
Conversation
Dependabot opened #287, #288, #289 and #290 within an hour of each other. Three of them move an action to the exact SHA this repository already uses elsewhere, so they are one change - 'use the version already pinned' - and merging them separately costs three serialised runs of the full suite on main (Julia tests alone is 20-35 minutes), plus a rebase of the remaining two after each merge. - actions/cache/restore and actions/cache/save 4.3.0 -> 6.1.0, the SHA actions/cache is already pinned at in six places. - actions/upload-artifact 4.6.2 -> 7.0.2, the SHA already pinned in four. - upload-sarif's comment claimed v4.38.0 and '4.38.1 blocked estate-wide', while the pinned SHA actually resolves to v4.39.0 on Dependabot's reading, so the note described a version the pin was already past. The comment now states what is true and why the SHA rather than the tag is the pin. github/codeql-action is now ignored by Dependabot: a pin that carries an estate-wide decision should be moved by hand with its comment, not silently. That leaves #290 (4.39.0 -> 4.39.1) as the owner's call rather than a bot's. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 12 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Change and reason
Dependabot opened four pull requests in an hour (#287, #288, #289, #290). Three of them move an action to the exact SHA this repository already pins elsewhere, so they are one change — "use the version already in use" — and merging them one at a time costs three serialised runs of the full suite on
main(Julia testsalone is 20–35 min), plus a rebase of the remaining two after each merge. This does the three in one pass and leaves the fourth to a person.actions/cache/restore,actions/cache/saveactions/cacheis already pinned at in six places inci.yml.actions/upload-artifactci.ymlline 501,hypatia-scan-reusable.yml×2).github/codeql-action/upload-sarifThe one that needed reading, not merging
#290 bumps
upload-sarif"from 4.39.0 to 4.39.1", while the comment beside the pin says:Two facts that do not fit together: Dependabot resolves the pinned SHA to 4.39.0, so the comment was already describing a version the pin had moved past, and it still records an estate-wide block on 4.38.1. A reviewer cannot tell from the diff whether the new SHA is blocked, allowed, or something else — the comment contradicts the pin.
So this PR does not take the 4.39.1 bump. It corrects the comment to state what is true (the SHA resolves to v4.39.0, and the SHA rather than the tag is the pin), and adds an
ignorerule so Dependabot stops rewriting a pin that carries an estate-wide decision:#290 stays open as the owner's call: it is a patch release whose only change is the bundled CodeQL version, and whether the estate's block reaches 4.39.x is not something this repository's files can answer.
Validation
All workflow files and
.github/dependabot.ymlparse as YAML, and the four changed SHAs are byte-identical to the ones already used in this repository (verified by grep, not by trust in the bot).Not run: the Julia and frontend suites — no Julia or TypeScript is touched. CI runs them.
Scope
Closing #287, #288 and #289 in favour of this, so the pending dependency work is one pull request instead of three. No pin moves to a SHA this repository does not already use; no
renv.lock,Manifest.tomlortool_versions.ymlchange.Contribution checks
main's tip and has no merge commits from it.