Repository navigation
chore(deps): update github-actions - #2777
Merged
Merged
Conversation
✅ Deploy Preview for vcluster-docs-site ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Collaborator
|
Holding for minimum release age to be met. |
renovate
Bot
force-pushed
the
renovate/github-actions
branch
from
September 14, 2026 20:22
9f878a5 to
dd7fa19
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/github-actions
branch
8 times, most recently
from
September 22, 2026 04:17
095d50b to
a025c3f
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/github-actions
branch
2 times, most recently
from
September 23, 2026 17:18
7874421 to
91dc7c1
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/github-actions
branch
2 times, most recently
from
September 25, 2026 06:22
72a6530 to
31f936e
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/github-actions
branch
from
September 27, 2026 14:17
31f936e to
30474ff
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/github-actions
branch
4 times, most recently
from
September 30, 2026 16:09
2d3c674 to
ce8b873
Compare
renovate
Bot
force-pushed
the
renovate/github-actions
branch
2 times, most recently
from
October 6, 2026 05:18
f2faedd to
cc919e9
Compare
renovate
Bot
force-pushed
the
renovate/github-actions
branch
from
October 6, 2026 06:17
cc919e9 to
878c4a7
Compare
Collaborator
|
The loft-sh and browserstack pins move to newer commits, and each loft-sh pin matches its current /v1 tag. The problem is tj-actions/changed-files. It moves from 9426d40 (v47.0.6, the latest release) to 24d32ff, which is v47.0.0 from Sept 2025. That's a downgrade: the v47 tag upstream was never moved forward, and Renovate followed it. Either fix that one line by hand to keep 9426d40, or set Renovate to track the full semver tag for this action. A downgrade is worth catching on that action in particular, because it's the one that was compromised in the 2025 supply-chain incident. Separately, it's still waiting on Renovate's stability-days check. @Piotr1215 can you take a look? |
Renovate kept pinning loft-sh actions to commit SHAs (#2724, #2813, and again in this PR). Our own actions publish rolling tags like ci-test-notify/v1; moving that tag is how a fix reaches every caller, so a SHA pin freezes this repo on an old revision until a bot PR lands. Widen the existing docs-backport-action pinDigests:false rule to loft-sh/** and restore the tag refs (docs-forwardport-action has no tags, so @main as before #2724). Also revert tj-actions/changed-files to 9426d40 and label it v47.0.6. The upstream v47 tag still points at v47.0.0, so Renovate's digest update for the "# v47" comment was a downgrade. A full semver comment makes Renovate follow releases instead. Claude-Session: https://claude.ai/code/session_013T3MJvuJPe4tJaWZGwAYZG
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
Follow-up to 2ced51f. pinDigests:false still let Renovate propose bumps on loft-sh refs. We own those tags: repointing ci-test-notify/v1 updates every caller at runtime, and a new major is a deliberate manual edit that will rarely happen. Renovate has nothing to do there, so disable it for loft-sh/**. Move the last @main ref, auto-approve-bot-prs, to its v1 tag so every github-actions dependency follows the same vN form. The reusable workflow file is identical at the tag and on main, so behaviour is unchanged. Claude-Session: https://claude.ai/code/session_013T3MJvuJPe4tJaWZGwAYZG
vcluster-bot-approver
approved these changes
Oct 7, 2026
vcluster-bot-approver
left a comment
vcluster-bot-approver
left a comment
Contributor
There was a problem hiding this comment.
Approved by the shared auto-approve workflow because this PR matched the approval criteria.
For more information, see https://github.com/loft-sh/github-actions?tab=readme-ov-file#auto-approve-bot-prs.
Piotr1215
added a commit
that referenced
this pull request
Oct 7, 2026
Internal actions follow their major tag (#2777): repointing the tag is how a fix reaches callers, and Renovate leaves loft-sh refs alone. docs-forwardport-action had no tags, so this caller sat on @main. The repo now carries v1 and v1.0.0 at 619fdc1, the same commit main points to, so behaviour is unchanged. Claude-Session: https://claude.ai/code/session_013T3MJvuJPe4tJaWZGwAYZG
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1ab56d9→1fad39ac40c1db→c6a76f1d462e845bee69a→d15a1df9426d40→24d32ffConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.