chore(deps): bump getsentry/github-workflows from 2 to 3#5240
chore(deps): bump getsentry/github-workflows from 2 to 3#5240dependabot[bot] wants to merge 1 commit intomainfrom
Conversation
Bumps [getsentry/github-workflows](https://github.com/getsentry/github-workflows) from 2 to 3. - [Release notes](https://github.com/getsentry/github-workflows/releases) - [Changelog](https://github.com/getsentry/github-workflows/blob/main/CHANGELOG.md) - [Commits](getsentry/github-workflows@v2...v3) --- updated-dependencies: - dependency-name: getsentry/github-workflows dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
| jobs: | ||
| danger: | ||
| uses: getsentry/github-workflows/.github/workflows/danger.yml@v2 | ||
| uses: getsentry/github-workflows/.github/workflows/danger.yml@v3 |
There was a problem hiding this comment.
Potential bug: The workflow references v3 but uses the incorrect v2 invocation syntax (.github/workflows/danger.yml@v3), which is a breaking change that will cause the action to fail.
-
Description: The GitHub workflow is being upgraded to use
getsentry/github-workflows@v3. However, the invocation syntax remains the v2 style, referencing the full workflow path like.github/workflows/danger.yml@v3. The v3 version of this workflow is a composite action and requires a different syntax, such asgetsentry/github-workflows/danger@v3. This mismatch will cause the GitHub Actions runner to fail when trying to locate and execute the workflow. This will prevent essential CI/CD jobs from running. A previous attempt to upgrade this repository reportedly failed due to this exact issue. -
Suggested fix: Update the
usesclause in the workflow file to use the correct v3 composite action syntax. For example, changeuses: getsentry/github-workflows/.github/workflows/danger.yml@v3touses: getsentry/github-workflows/danger@v3. This change should be applied to all affected workflows.
severity: 0.85, confidence: 0.95
Did we get this right? 👍 / 👎 to inform future reviews.
|
Since changes are needed I will follow up with #5218 (which is currently blocked) |
|
Looks like getsentry/github-workflows is up-to-date now, so this is no longer needed. |
Bumps getsentry/github-workflows from 2 to 3.
Release notes
Sourced from getsentry/github-workflows's releases.
... (truncated)
Changelog
Sourced from getsentry/github-workflows's changelog.
... (truncated)
Commits
342f5e2release: 3.0.091b2c01chore: Clean up changelog by removing outdated version sections and redundant...13193d2fix: Handle null bullet point detection in update-changelog script (#125)67d5a87feat!: Change updater pr-strategy default to 'update' (#124)45bc4f7fix: Improve bullet-point resolution when plain text precedes bullet points (...5f024a8test: Convert workflow test scripts to use PowerShell and Pester (#122)747517afeat: Allow updater to target non-default branches (#118)de9e3fafeat: Support GitHub release title pattern matching (#117)1dbbc41Add git commit fallback for repositories without changelog files (#116)6af5c2dfix: improve changelog generation for non-tagged commits and edge cases (#115)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)