chore(deps): bump the github-actions group across 1 directory with 2 updates#28
Conversation
…updates Bumps the github-actions group with 2 updates in the / directory: [actions/setup-go](https://github.com/actions/setup-go) and [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `actions/setup-go` from 6.3.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@4b73464...4a36011) Updates `codecov/codecov-action` from 5.5.2 to 6.0.0 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@671740a...57e3a13) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: codecov/codecov-action dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
Greptile SummaryThis is a Dependabot PR that bumps two GitHub Actions in all CI/CD workflow files:
Confidence Score: 5/5Safe to merge — only SHA-pinned GitHub Actions version bumps with no code logic changes; all remaining findings are P2 style notes. All three changed files are GitHub Actions workflow files with straightforward dependency bumps. The setup-go change is a non-breaking minor patch. The codecov major bump has a Node 24 caveat, but GitHub-hosted ubuntu-latest runners support it. The only introduced issue is a stale # v5 comment, which is a cosmetic P2. No P0/P1 findings exist. .github/workflows/ci.yml — stale version comment on the codecov action line, and the Node 24 note for v6.0.0 is worth a quick sanity check. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A["Dependabot PR #28"] --> B["actions/setup-go\n6.3.0 → 6.4.0\n(minor patch)"]
A --> C["codecov/codecov-action\n5.5.2 → 6.0.0\n(major bump)"]
B --> D["ci.yml\nrc.yml\nrelease.yml"]
C --> E["ci.yml only"]
D --> F["SHA updated ✓\nComment: # v5 (unchanged, pre-existing)"]
E --> G["SHA updated ✓\nComment: still # v5 ⚠️ should be # v6"]
C --> H["⚠️ Node 24 required\nubuntu-latest: supported ✓"]
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
|
||
| - name: Upload coverage | ||
| uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5 | ||
| uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v5 |
There was a problem hiding this comment.
The codecov/codecov-action was bumped from v5.5.2 to v6.0.0 in this PR, but the inline version comment was not updated — it still reads # v5 when it should now be # v6. Dependabot updated the SHA correctly but left the human-readable tag comment behind.
| uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v5 | |
| uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6 |
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/ci.yml
Line: 65
Comment:
**Stale version comment after major version bump**
The `codecov/codecov-action` was bumped from v5.5.2 to v6.0.0 in this PR, but the inline version comment was not updated — it still reads `# v5` when it should now be `# v6`. Dependabot updated the SHA correctly but left the human-readable tag comment behind.
```suggestion
uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
```
How can I resolve this? If you propose a fix, please make it concise.
dependabot
bot
deleted the
dependabot/github_actions/github-actions-beba5d049a
branch
1 participant
Bumps the github-actions group with 2 updates in the / directory: actions/setup-go and codecov/codecov-action.
Updates
actions/setup-gofrom 6.3.0 to 6.4.0Release notes
Sourced from actions/setup-go's releases.
Commits
4a36011docs: fix Microsoft build of Go link (#734)8f19afcfeat: add go-download-base-url input for custom Go distributions (#721)27fdb26Bump minimatch from 3.1.2 to 3.1.5 (#727)def8c39Rearrange README.md, add advanced-usage.md (#724)Updates
codecov/codecov-actionfrom 5.5.2 to 6.0.0Release notes
Sourced from codecov/codecov-action's releases.
Changelog
Sourced from codecov/codecov-action's changelog.
... (truncated)
Commits
57e3a13Th/6.0.0 (#1928)f67d33dRevert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0""...75cd116chore(release): 5.5.4 (#1927)87d39f4Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" (#1926)1af5884chore(release): bump to 5.5.3 (#1922)c143300build(deps): bump actions/github-script from 7.0.1 to 8.0.0 (#1874)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions