From 1c67e76a42de2ea8c165b4114e6bae73cc443b2a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 18:28:23 +0000 Subject: [PATCH 1/2] build(deps): bump the actions-updates group across 1 directory with 2 updates Bumps the actions-updates group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout) and [bufbuild/buf-action](https://github.com/bufbuild/buf-action). Updates `actions/checkout` from 6.0.1 to 7.0.1 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/8e8c483db84b4bee98b60c0593521ed34d9990e8...3d3c42e5aac5ba805825da76410c181273ba90b1) Updates `bufbuild/buf-action` from 1.3.0 to 1.5.0 - [Release notes](https://github.com/bufbuild/buf-action/releases) - [Changelog](https://github.com/bufbuild/buf-action/blob/main/RELEASE.md) - [Commits](https://github.com/bufbuild/buf-action/compare/8f4a1456a0ab6a1eb80ba68e53832e6fcfacc16c...8c6a16e16f12ba20b6470afa9c2ba9b5ba8c97c3) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-updates - dependency-name: bufbuild/buf-action dependency-version: 1.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-updates ... Signed-off-by: dependabot[bot] --- .github/workflows/buf-ci.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/buf-ci.yaml b/.github/workflows/buf-ci.yaml index f0ed3ec..ae94931 100644 --- a/.github/workflows/buf-ci.yaml +++ b/.github/workflows/buf-ci.yaml @@ -11,8 +11,8 @@ jobs: buf: runs-on: ubuntu-latest steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4.2.0 - - uses: bufbuild/buf-action@8f4a1456a0ab6a1eb80ba68e53832e6fcfacc16c # v1.3.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4.2.0 + - uses: bufbuild/buf-action@8c6a16e16f12ba20b6470afa9c2ba9b5ba8c97c3 # v1.5.0 with: # Publishing schema changes to the BSR requires a BSR authentication token. token: ${{ secrets.BUF_TOKEN }} From 280ad71afebb4c2ada5a1a6510de6159e32c4d9b Mon Sep 17 00:00:00 2001 From: Benjamin Leggett Date: Wed, 19 Aug 2026 16:47:55 -0400 Subject: [PATCH 2/2] fixup dependabot with new buf behavior --- .github/workflows/buf-ci.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/buf-ci.yaml b/.github/workflows/buf-ci.yaml index ae94931..f4d08fb 100644 --- a/.github/workflows/buf-ci.yaml +++ b/.github/workflows/buf-ci.yaml @@ -13,6 +13,10 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4.2.0 - uses: bufbuild/buf-action@8c6a16e16f12ba20b6470afa9c2ba9b5ba8c97c3 # v1.5.0 + # Dependabot runs read the Dependabot secret store, so secrets.BUF_TOKEN is + # empty there and the BSR push fails. Nothing in a dependabot PR touches the + # protos, so skip the whole step. + if: github.actor != 'dependabot[bot]' with: # Publishing schema changes to the BSR requires a BSR authentication token. token: ${{ secrets.BUF_TOKEN }}