Skip to content

chore(deps): bump the gha-deps group across 1 directory with 2 updates - #10

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/gha-deps-af0f55f0b6
Open

chore(deps): bump the gha-deps group across 1 directory with 2 updates#10
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/gha-deps-af0f55f0b6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the gha-deps group with 2 updates in the / directory: actions/checkout and actions/setup-java.

Updates actions/checkout from 6 to 7

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.1.0

What's Changed

https://github.blog/changelog/2026-06-18-safer-pull_request_target-defaults-for-github-actions-checkout/ for more details about this breaking change

Full Changelog: actions/checkout@v6.0.3...v6.1.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates actions/setup-java from 5 to 6

Release notes

Sourced from actions/setup-java's releases.

v6.0.0

What's Changed

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the gha-deps group across 1 directory with 2 updates
4d4e105 
Bumps the gha-deps group with 2 updates in the / directory: [actions/checkout](https://github.com/actions/checkout) and [actions/setup-java](https://github.com/actions/setup-java).


Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6...v7)

Updates `actions/setup-java` from 5 to 6
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](actions/setup-java@v5...v6)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-deps
- dependency-name: actions/setup-java
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: gha-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 31, 2026
@eseidel eseidel changed the title Bump the gha-deps group across 1 directory with 2 updates chore(deps): bump the gha-deps group across 1 directory with 2 updates Sep 8, 2026
@eseidel eseidel mentioned this pull request Sep 8, 2026
Open
@eseidel Claude

eseidel commented Sep 8, 2026

Copy link
Copy Markdown

Looked at this as part of a sweep of open Dependabot PRs. Two separate failures here, one of which I've fixed.

1. semantic-pull-request — fixed. The title was Bump the gha-deps group across 1 directory with 2 updates, with no semantic prefix. I've retitled it to chore(deps): bump the gha-deps group across 1 directory with 2 updates, which matches what Dependabot produces in the other repos. Worth adding a commit-message.prefix: chore to this repo's .github/dependabot.yml so future PRs land correctly on their own — shorebird-release already gets this right.

2. e2e on all three OSes — not caused by this bump, and not fixable from inside the PR. main.yaml:14 sets SHOREBIRD_TOKEN: ${{ secrets.SHOREBIRD_TOKEN }}, and GitHub does not expose regular Actions secrets to Dependabot-triggered workflows; they live in a separate Dependabot secrets store. The variable interpolates to empty and shorebird init fails with:

Failed to parse SHOREBIRD_TOKEN. Expected an API key (sb_api_...) or a legacy CI token.

before either bumped action is exercised. So no Dependabot PR in this repo can go green until that's addressed — it has nothing to do with actions/checkout@v7 or actions/setup-java@v6.

That's a credential-placement decision rather than a code change, so I've left it for a human. Options, in order of preference:

  1. Add SHOREBIRD_TOKEN under Settings → Secrets and variables → Dependabot.
  2. Skip the e2e job for Dependabot actors (if: github.actor != 'dependabot[bot]'), accepting the loss of e2e coverage on dependency PRs.
  3. pull_request_target — hands secrets to PR-provided code; I wouldn't recommend it.

The diff itself only touches this repo's own workflow, not action.yml, so nothing that ships to consumers of this action changes.

Same blocker applies to shorebirdtech/shorebird-release#25.

Generated by Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@eseidel