chore(deps): bump the actions group across 1 directory with 8 updates#15
Open
dependabot[bot] wants to merge 1 commit intomainfrom
Open
chore(deps): bump the actions group across 1 directory with 8 updates#15dependabot[bot] wants to merge 1 commit intomainfrom
dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
dependabot
Bot
added
dependencies
Benchmark ReportCommit: Sequence Lock (mantis-seqlock)LinuxCPU: seqlock_read_contended
seqlock_read_uncontended
seqlock_write
macOSCPU: seqlock_read_contended
seqlock_read_uncontended
seqlock_write
Fixed-Point Arithmetic (mantis-fixed)LinuxCPU: fixed_checked_add
fixed_checked_div
fixed_checked_mul_trunc
fixed_decimal_parse
fixed_display
fixed_mul_round_vs_trunc
fixed_parse
fixed_rescale
macOSCPU: fixed_checked_add
fixed_checked_div
fixed_checked_mul_trunc
fixed_decimal_parse
fixed_display
fixed_mul_round_vs_trunc
fixed_parse
fixed_rescale
Market-State Engine (mantis-market-state)LinuxCPU: market_state_array_book
market_state_engine
macOSCPU: market_state_array_book
market_state_engine
|
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-818213016a
branch
5 times, most recently
from
50ce89b to
32332fa
Compare
Bumps the actions group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.3.1` | `6.0.2` | | [benchmark-action/github-action-benchmark](https://github.com/benchmark-action/github-action-benchmark) | `1.21.0` | `1.22.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `7.0.0` | | [actions/download-artifact](https://github.com/actions/download-artifact) | `4.2.1` | `8.0.1` | | [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment) | `2.9.1` | `3.0.2` | | [taiki-e/install-action](https://github.com/taiki-e/install-action) | `2.69.9` | `2.70.3` | | [dorny/test-reporter](https://github.com/dorny/test-reporter) | `1.9.1` | `3.0.0` | | [codecov/codecov-action](https://github.com/codecov/codecov-action) | `5.5.3` | `6.0.0` | Updates `actions/checkout` from 4.3.1 to 6.0.2 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@34e1148...de0fac2) Updates `benchmark-action/github-action-benchmark` from 1.21.0 to 1.22.0 - [Release notes](https://github.com/benchmark-action/github-action-benchmark/releases) - [Changelog](https://github.com/benchmark-action/github-action-benchmark/blob/master/CHANGELOG.md) - [Commits](benchmark-action/github-action-benchmark@a7bc236...a60cea5) Updates `actions/upload-artifact` from 4.6.2 to 7.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@ea165f8...bbbca2d) Updates `actions/download-artifact` from 4.2.1 to 8.0.1 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@95815c3...3e5f45b) Updates `marocchino/sticky-pull-request-comment` from 2.9.1 to 3.0.2 - [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases) - [Commits](marocchino/sticky-pull-request-comment@52423e0...70d2764) Updates `taiki-e/install-action` from 2.69.9 to 2.70.3 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@328a871...6ef672e) Updates `dorny/test-reporter` from 1.9.1 to 3.0.0 - [Release notes](https://github.com/dorny/test-reporter/releases) - [Changelog](https://github.com/dorny/test-reporter/blob/main/CHANGELOG.md) - [Commits](dorny/test-reporter@31a54ee...a43b3a5) Updates `codecov/codecov-action` from 5.5.3 to 6.0.0 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@1af5884...57e3a13) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: benchmark-action/github-action-benchmark dependency-version: 1.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: actions/upload-artifact dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/download-artifact dependency-version: 8.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: marocchino/sticky-pull-request-comment dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: taiki-e/install-action dependency-version: 2.70.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: dorny/test-reporter dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: codecov/codecov-action dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/actions-818213016a
branch
from
32332fa to
e2ec71e
Compare
📝 WalkthroughWalkthroughMultiple GitHub Actions workflows are updated with newer pinned versions across checkout, artifact upload/download, testing, reporting, and code coverage actions. Each workflow step reference is bumped to newer stable versions while preserving all existing configuration, inputs, and logic. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/bench.yml (1)
152-152: Minor version discrepancy in PR description.The code pins
marocchino/sticky-pull-request-commentto v3.0.4, but the PR description mentions v3.0.2. This is fine (v3.0.4 is newer), but worth noting for accuracy.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/bench.yml at line 152, The PR description and the workflow pin are inconsistent: the workflow uses the action reference "marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0" (v3.0.4) while the PR text mentions v3.0.2; decide which version is intended and make them consistent by either updating the workflow action reference to the v3.0.2 tag/SHA or updating the PR description to state v3.0.4 so the "uses: marocchino/sticky-pull-request-comment@0ea0beb66..." line and the PR description match.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/bench.yml:
- Around line 128-134: Update the inline version comments for the two
occurrences of actions/download-artifact (the block that downloads Ubuntu
results and the one that downloads macOS results) to reflect the actual SHA
being used: change the comment text from "# v4" to "# v8.0.1" so the inline
comments match the referenced commit SHA
`3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` in both places.
---
Nitpick comments:
In @.github/workflows/bench.yml:
- Line 152: The PR description and the workflow pin are inconsistent: the
workflow uses the action reference
"marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0"
(v3.0.4) while the PR text mentions v3.0.2; decide which version is intended and
make them consistent by either updating the workflow action reference to the
v3.0.2 tag/SHA or updating the PR description to state v3.0.4 so the "uses:
marocchino/sticky-pull-request-comment@0ea0beb66..." line and the PR description
match.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ea0b202b-a5df-4bcf-b6a7-117a6cdf3092
📒 Files selected for processing (4)
.github/workflows/bench.yml.github/workflows/ci.yml.github/workflows/nightly.yml.github/workflows/verify.yml
Comment on lines
+128
to
+134
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v4 | ||
| with: | ||
| name: benchmark-results-ubuntu-latest | ||
| path: results/linux | ||
| continue-on-error: true | ||
| - name: Download macOS results | ||
| uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4 | ||
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the download-artifact SHA corresponds to the expected version
# Check the GitHub API for the tag associated with this commit
curl -s "https://api.github.com/repos/actions/download-artifact/git/commits/3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" | jq -r '.message // "Not found"'Repository: Milerius/Mantis
Length of output: 284
🌐 Web query:
GitHub actions/download-artifact releases v4 v8 SHA 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
💡 Result:
The SHA 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c is the Git commit "Add regression tests for CJK characters (#471)" by Daniel Kennedy on 2026-03-11, part of the changes leading to the actions/download-artifact v8.0.1 release. This commit addresses support for CJK (Chinese, Japanese, Korean) characters in artifact names and adds related regression tests. It is one of the final commits before the v8.0.1 tag, released on 2026-03-11. v4 refers to the major version actions/download-artifact@v4 (initial release Dec 2023), with subsequent minor/patch releases up to v4.3.0 (Apr 2025). v8 is the latest major version (v8.0.1 as of Mar 2026), introducing ESM migration, enforced digest checks (default to error on mismatch), support for direct (non-zipped) downloads without auto-unzipping, and Node.js 24 runtime. v8 is not backward-compatible with v3 artifacts and has GHES limitations (use v3 there). Official documentation and usage: https://github.com/actions/download-artifact
Citations:
- 1: https://github.com/actions/download-artifact/releases
- 2: actions/download-artifact@v4...v8
- 3: https://github.com/actions/download-artifact/releases/tag/v8.0.0
- 4: https://github.com/actions/download-artifact/releases/tag/v8.0.1
🏁 Script executed:
#!/bin/bash
# Query the actions/download-artifact repository for releases and tags
# Check which version(s) this SHA corresponds to
curl -s "https://api.github.com/repos/actions/download-artifact/releases" | jq -r '.[] | "\(.tag_name): \(.target_commitish)"' | head -20Repository: Milerius/Mantis
Length of output: 607
🏁 Script executed:
#!/bin/bash
# More directly, check if we can get tag info for this specific SHA
curl -s "https://api.github.com/repos/actions/download-artifact/git/refs/tags" | jq -r '.[] | select(.object.sha == "3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c") | .ref'Repository: Milerius/Mantis
Length of output: 88
Update version comment for actions/download-artifact from v4 to v8.0.1.
The SHA 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c corresponds to v8.0.1, not v4. Update the inline comments on lines 128 and 134 from # v4 to # v8.0.1 to match the actual version being used.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/bench.yml around lines 128 - 134, Update the inline
version comments for the two occurrences of actions/download-artifact (the block
that downloads Ubuntu results and the one that downloads macOS results) to
reflect the actual SHA being used: change the comment text from "# v4" to "#
v8.0.1" so the inline comments match the referenced commit SHA
`3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` in both places.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the actions group with 8 updates in the / directory:
4.3.16.0.21.21.01.22.04.6.27.0.04.2.18.0.12.9.13.0.22.69.92.70.31.9.13.0.05.5.36.0.0Updates
actions/checkoutfrom 4.3.1 to 6.0.2Release notes
Sourced from actions/checkout's releases.
... (truncated)
Changelog
Sourced from actions/checkout's changelog.
... (truncated)
Commits
de0fac2Fix tag handling: preserve annotations and explicit fetch-tags (#2356)064fe7fAdd orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set (...8e8c483Clarify v6 README (#2328)033fa0dAdd worktree support for persist-credentials includeIf (#2327)c2d88d3Update all references from v5 and v4 to v6 (#2314)1af3b93update readme/changelog for v6 (#2311)71cf226v6-beta (#2298)069c695Persist creds to a separate file (#2286)ff7abcdUpdate README to include Node.js 24 support details and requirements (#2248)08c6903Prepare v5.0.0 release (#2238)Updates
benchmark-action/github-action-benchmarkfrom 1.21.0 to 1.22.0Release notes
Sourced from benchmark-action/github-action-benchmark's releases.
Changelog
Sourced from benchmark-action/github-action-benchmark's changelog.
... (truncated)
Commits
a60cea5release v1.22.0Updates
actions/upload-artifactfrom 4.6.2 to 7.0.0Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)47309c9Merge pull request #754 from actions/Link-/add-proxy-integration-tests02a8460Add proxy integration testb7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEddc45eddocs: update README to correct action name for Node.js 24 support615b319chore: release v6.0.0 for Node.js 24 support017748bMerge pull request #744 from actions/fix-storage-blob38d4c79chore: rebuild distUpdates
actions/download-artifactfrom 4.2.1 to 8.0.1Release notes
Sourced from actions/download-artifact's releases.
... (truncated)
Commits
3e5f45bAdd regression tests for CJK characters (#471)e6d03f6Add a regression test for artifact name + content-type mismatches (#472)70fc10cMerge pull request #461 from actions/danwkennedy/digest-mismatch-behaviorf258da9Add change docsccc058eFix linting issuesbd7976bAdd a setting to specify what to do on hash mismatch and default it toerrorac21fcfMerge pull request #460 from actions/danwkennedy/download-no-unzip15999bfAdd note about package bumps974686eBump the version tov8and add release notesfbe48b1Update test names to make it clearer what they doUpdates
marocchino/sticky-pull-request-commentfrom 2.9.1 to 3.0.2Release notes
Sourced from marocchino/sticky-pull-request-comment's releases.
... (truncated)
Commits
70d2764📦️ Build308b2fdDon't create a comment with hide: true (#1661)3bbec31Add comprehensive tests for main.ts covering all branches (#1660)aaf6178🔖 Version bump (#1658)7d67ef6👷 Use pull_request1ed3d7b⬆️ Update deps46a16ecbuild(deps-dev): Bump@types/nodefrom 24.5.2 to 25.0.3 (#1646)0a36b9ebuild(deps): Bump@actions/corefrom 1.11.1 to 2.0.2 (#1649)74297c9build(deps-dev): Bump@vercel/nccfrom 0.38.3 to 0.38.4 (#1592)e736d73📦️ BuildUpdates
taiki-e/install-actionfrom 2.69.9 to 2.70.3Release notes
Sourced from taiki-e/install-action's releases.
Changelog
Sourced from taiki-e/install-action's changelog.
... (truncated)
Commits
6ef672eRelease 2.70.3f89faaaUpdatewasm-bindgen@latestto 0.2.1169adcff1Updatecargo-insta@latestto 1.47.2a322a79Updatetombi@latestto 0.9.12875d0e5Updatebiome@latestto 2.4.10e9e8e03Release 2.70.2f225969Updatevacuum@latestto 0.25.32e8700aUpdatetombi@latestto 0.9.1141213fbzizmor: Apply more lintsfd0f63eRelease 2.70.1Updates
dorny/test-reporterfrom 1.9.1 to 3.0.0Release notes
Sourced from dorny/test-reporter's releases.
... (truncated)
Changelog
Sourced from dorny/test-reporter's changelog.
... (truncated)
Commits
a43b3a5test-reporter release v3.0.079216dcMerge pull request #744 from dorny/dependabot/npm_and_yarn/flatted-3.4.262c3873Merge pull request #745 from dorny/feature/workflow_permissionsbd74ca6Explicitly use lowest permissions required to run workflow0c2b2aaMerge pull request #738 from dav-tb/feature/node24-runtimef7eee30Use the@types/nodedefinitions for NodeJS 24 runtimead0a96fUpgrade action runtime to Node.js 24543415cMerge pull request #741 from dorny/release/v2.7.0f1284d0Bump flatted from 3.4.1 to 3.4.23c1b53fMerge pull request #743 from dorny/dependabot/npm_and_yarn/types/adm-zip-0.5.8Updates
codecov/codecov-actionfrom 5.5.3 to 6.0.0Release notes
Sourced from codecov/codecov-action's releases.
Changelog
Sourced from codecov/codecov-action's changelog.