chore(deps): re-derive every action pin at today's latest - #36
Merged
Conversation
Replaces Dependabot #23 and #24, which were raised a month apart and each moved one pin. Consolidating them means the repo lands on one coherent set computed today rather than on whatever two stale snapshots happen to say. Every SHA-pinned action here was re-resolved from its own repository -- tag from releases/latest, then that tag dereferenced to a commit SHA, so the comment and the pin cannot disagree: actions/checkout v7.0.0 -> v7.0.1 (6 sites) actions/download-artifact v8.0.0 -> v8.0.1 (1 site) actions/setup-node v7.0.0 already latest actions/upload-artifact v7.0.1 already latest oven-sh/setup-bun v2.2.0 already latest The sweep is spacing-agnostic on purpose. These files mix one and two spaces before the version comment, and an earlier pass in another repo that matched a fixed number of spaces silently missed 3 of 13 sites -- a diff reads as clean when the misses simply are not in it. Counted instead: 6 and 1 replaced, 0 old SHAs left, 6 and 1 new SHAs present. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017EbNct32BA3E96EER8Y1eE
This was referenced Aug 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces Dependabot #23 and #24 (both raised 2026-07-25, one pin each). One PR computed today beats two stale single-pin snapshots.
How the pins were derived
Each action was re-resolved from its own repository —
releases/latestfor the tag, then that tag dereferenced to a commit SHA — so the pin and the trailing# vX.Y.Zcomment cannot disagree with each other.actions/checkoutactions/download-artifactactions/setup-nodeactions/upload-artifactoven-sh/setup-bunWhy the sweep is spacing-agnostic
These files mix one and two spaces before the version comment. An earlier pass in another repo matched a fixed number of spaces and silently missed 3 of 13 sites — and a diff full of correct-looking replacements reads as clean, because the misses are exactly what is not in it.
So the check is a count, not a read:
Verification
actionlinton this PR. The workflows themselves are exercised by every plugin repo that calls them.