search

theupdateframework / specification

The Update Framework specification
https://theupdateframework.github.io/specification/
Other
368 stars 54 forks source link

Bump all outdated actions #300

Open dependabot[bot] opened 7 months ago

dependabot[bot] commented 7 months ago

Bumps actions/checkout from 3df4ab11eba7bda6032a0b82a6bb43b11571feac to aadec899646c8e0f34c52d9219c2faac36626b55.

Changelog

Sourced from actions/checkout's changelog.

Changelog

v4.1.0

v4.0.0

v3.6.0

v3.5.3

v3.5.2

v3.5.1

v3.5.0

v3.4.0

v3.3.0

v3.2.0

v3.1.0

v3.0.2

... (truncated)

Commits


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
joshuagl commented 7 months ago

I pushed a follow-on cleanup commit to this branch which ensures we're on the latest version of all the GHA we're using and adds a comment after the digest so we can more easily tell which version we're using. Dependabot will update the comments for us as it suggests bumps in future.

trishankatdatadog commented 7 months ago

Dependabot will update the comments for us as it suggests bumps in future.

Wasn't obvious why at all to me until I searched for it. Thanks for the PR!

trishankatdatadog commented 7 months ago

@joshuagl I am confused about one thing. Why did dependabot choose something newer but unversion, but you chose something older but versioned?

joshuagl commented 7 months ago

Great question @trishankatdatadog ! I believe dependabot resolved main (though two new commits have been made since then) whereas I am pinning to a release.

dependabot[bot] commented 7 months ago

A newer version of actions/checkout exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

trishankatdatadog commented 7 months ago

Great question @trishankatdatadog ! I believe dependabot resolved main (though two new commits have been made since then) whereas I am pinning to a release.

Yeap, looks like it. Out of curiosity, did you resolve the hashes/versions manually or did you use tooling?

joshuagl commented 7 months ago

I was playing around with frizbee a bit, so I got the hashes automatically but verified them by eye.

trishankatdatadog commented 7 months ago

I was playing around with frizbee a bit, so I got the hashes automatically but verified them by eye.

Useful tip, thanks!