') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); ci: let Dependabot scan the tend-setup and build-js composite actions by prql-bot · Pull Request #6177 · PRQL/prql · GitHub
Skip to content

ci: let Dependabot scan the tend-setup and build-js composite actions - #6177

Merged
max-sixty merged 1 commit into
mainfrom
daily/review-runs-31369430836
Aug 15, 2026
Merged

ci: let Dependabot scan the tend-setup and build-js composite actions#6177
max-sixty merged 1 commit into
mainfrom
daily/review-runs-31369430836

Conversation

@prql-bot

@prql-botprql-bot commented Aug 10, 2026•
edited
Loading

Copy link
Copy Markdown
Collaborator

For the github-actions ecosystem, Dependabot's directory: "/" only covers .github/workflows/. Composite actions under .github/actions/ are scanned only if they are listed explicitly — which is why four of them already are. Two are not: .github/actions/tend-setup and .github/actions/build-js. Their uses: refs have never been scanned.

That gap has already cost one update. Dependabot's #5891 (chore: bump go-task/setup-task from 1 to 2, merged 2026-05-14) touched exactly three files — build-web.yaml, test-php.yaml, test-prqlc-c.yaml — all of them under /. .github/actions/tend-setup/action.yaml uses the same action and was left on @v1, where it has sat for nearly three months while v2.0.0, v2.1.0 and v2.2.0 shipped. Every one of the eight tend-* workflows runs through that action, so it is the most-executed uses: ref in the repo and the one that had no watcher.

This PR adds both directories to the list (sorted, so ls .github/actions/ is a checkable invariant, with a comment recording why / isn't enough) and applies the one bump the gap swallowed.

On the v1 → v2 bump specifically: the only breaking change in v2.0.0 is the runtime moving from Node 20 to Node 24. The input surface at v2 is a superset of v1 — version, repo-token and max-retries are all still there, with checksum added in v2.2.0 — so the existing repo-token / version: 3.52.0 block needs no change. The three workflow files bumped by #5891 have been running @v2 with the identical version: 3.52.0 input since May, which is the strongest available evidence that the bump is a no-op here.

build-js's three refs (baptiste0928/cargo-install@v3, actions/setup-node@v7, Swatinem/rust-cache@v2) are all at their current majors, so listing it changes nothing today — it just stops the same silent drift from starting there.

The cost, stated plainly: directories: fans a shared-action bump out into one PR per listed directory, not one PR overall — actions/upload-artifact 5→7 landed as five separate PRs (#5889, #5892, #5893, #5894, #5895). Going from five listed directories to seven raises that ceiling, and both baptiste0928/cargo-install and Swatinem/rust-cache are now referenced from several listed directories, so a major bump on either fans out the same way. That seems clearly worth paying against three months of an unwatched stale ref, and the fan-out is a pre-existing property of this config rather than something this change introduces — but it's a maintainer's call, and if it turns noisy a groups: block on this ecosystem entry is the lever.

How this surfaced, and scope notes

Found during the daily review-runs sweep (31369430836). The symptom was half-surfaced a run earlier: the 08-09 tend-weekly session (31306003041) noticed the @v1/@v2 split while doing its setup-task version-pin task and correctly left it alone as out of scope — "the major-version drift may be unintentional". It reported the drift but not the cause; the cause is this config gap.

The commented-out macOS job in tests.yaml also references go-task/setup-task@v1 (around line 297), but it is inside a fully commented-out block, so it's dead text — left untouched rather than adding diff noise.

No overlap with the other open PR touching this file: #6144 modifies the final run: block of tend-setup/action.yaml, this touches the first uses:. Different hunks.

@prql-botprql-bot added the review-runs Findings from tend-review-runs daily analysis label Aug 10, 2026
prql-bot
prql-bot commented Aug 10, 2026
View reviewed changes

@prql-botprql-bot left a comment

Copy link
Copy Markdown
CollaboratorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Diff is correct. Verified independently:

  • The new list is exactly ls .github/actions/ (six entries, sorted), and both newly-listed actions are live — build-js is consumed by release.yaml, tend-setup by all eight tend-* workflows.
  • go-task/setup-task@v2 with repo-token + version: 3.52.0 is already running in build-web.yaml, test-php.yaml and test-prqlc-c.yaml since #5891, so the input block genuinely needs no change.
  • build-js's three refs are at current majors (setup-node@v7 matches the #6080 bump), so listing it is a no-op today, as the description says.
  • No conflict with #6144 — that PR only appends to the final run: block; this one touches line 15.

One trade-off the description doesn't state, worth a maintainer's eye before merge: directories: fans a shared-action bump out into one PR per listed directory, not one PR overall. actions/upload-artifact 5→7 landed as five separate PRs across the five directories listed at the time — #5889, #5892, #5893, #5894, #5895. Going from five listed directories to seven raises that ceiling accordingly, and baptiste0928/cargo-install and Swatinem/rust-cache are now each referenced from several listed directories, so a major bump on either would fan out the same way.

That cost is clearly worth paying — the alternative is what this PR is fixing, tend-setup sitting on a stale ref for three months with no watcher — and the fan-out is a pre-existing property of the config rather than something this change introduces. Flagging it only because "two more Dependabot PRs per shared-action major bump" is the kind of thing that's better decided now than discovered later. If it becomes noisy, a groups: block on this ecosystem entry is the lever to reach for.

Self-authored, so no approval from me — this needs a human.

This was referenced Aug 10, 2026
Open
Merged
@max-sixty
max-sixty merged commit 929bdf0 into mainAug 15, 2026
59 of 73 checks passed
@max-sixty
max-sixty deleted the daily/review-runs-31369430836 branch August 15, 2026 14:55
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

review-runsFindings from tend-review-runs daily analysis

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@prql-bot@max-sixty