You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by @dependabot[bot] in actions/checkout#2458
You can trigger a rebase of this PR by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.
Dependabot's release.yml bump failed `dist plan` because cargo-dist 0.32.0
still templates checkout@v6. Pin the v7.0.0 SHA via github-action-commits
and regenerate so plan stays consistent with ci/publish workflows.
Co-authored-by: Michael Assaf <snowmead@users.noreply.github.com>
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Thermos review
No medium+ findings (security + code quality).
Pins actions/checkout to verified v7.0.0 SHA (9c091bb…) via [dist.github-action-commits] and regenerates cargo-dist release.yml to match existing ci/publish pins. Checkout v7’s fork-PR restriction does not apply here (pull_request / tag push only). dist plan is green. No Bugbot or prior review threads.
Cause: Dependabot only edited the generated release.yml (checkout@v6 → @v7). cargo-dist 0.32.0 still templates @v6, so plan failed with “out of date contents”.
Change: Pin actions/checkout to the v7.0.0 SHA via [dist.github-action-commits] in dist-workspace.toml and regenerate release.yml. Same SHA already used by ci.yml / publish workflows.
CI + Release plan are green; squash auto-merge is enabled.
cursorBot
changed the title
chore(deps): bump actions/checkout from 6 to 7
chore(deps): pin actions/checkout@v7 in cargo-dist release workflow
Jul 31, 2026
The reason will be displayed to describe this comment to others. Learn more.
Thermos review
No medium+ findings (security + code quality).
Pins actions/checkout to verified v7.0.0 SHA (9c091bb…) via [dist.github-action-commits] and regenerates cargo-dist release.yml to match existing ci/publish pins. Re-checked after main merge (d26cb5d); checkout v7’s fork-PR restriction still does not apply (pull_request / tag push only). plan is green. No Bugbot or prior review threads.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filegithub_actionsPull requests that update GitHub Actions code
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/checkout from 6 to 7.
Release notes
Sourced from actions/checkout's releases.
Commits
9c091bbupdate error wording (#2467)1044a6dgetting ready for checkout v7 release (#2464)f028218Bump the minor-npm-dependencies group across 1 directory with 3 updates (#2462)d914b26upgrade module to esm and update dependencies (#2463)537c7efBump@actions/coreand@actions/tool-cacheand Remove uuid (#2459)130a169Bump js-yaml from 4.1.0 to 4.2.0 (#2461)7d09575Bump flatted from 3.3.1 to 3.4.2 (#2460)0f9f3aaBump actions/publish-immutable-action (#2458)f9e715ablock checking out fork pr for pull_request_target and workflow_run (#2454)You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)