From 4d3fec2f42a02e9315b21c06d5047fd3017b59ee Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 22 Jun 2026 23:14:40 +0000 Subject: [PATCH 1/2] chore(deps): bump actions/checkout from 6 to 7 Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/ci.yml | 2 +- .github/workflows/publish-crates.yml | 2 +- .github/workflows/publish-npm.yml | 2 +- .github/workflows/release.yml | 10 +++++----- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c2461d7..babdbb3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,7 +18,7 @@ jobs: name: ci runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4.2.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4.2.2 - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # master with: diff --git a/.github/workflows/publish-crates.yml b/.github/workflows/publish-crates.yml index d6e91e8..7bdd0e8 100644 --- a/.github/workflows/publish-crates.yml +++ b/.github/workflows/publish-crates.yml @@ -15,7 +15,7 @@ jobs: publish-crates: runs-on: ubuntu-latest steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4.2.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4.2.2 - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # master diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml index 32a4c56..fc969f6 100644 --- a/.github/workflows/publish-npm.yml +++ b/.github/workflows/publish-npm.yml @@ -36,7 +36,7 @@ jobs: permissions: id-token: write steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4.2.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4.2.2 - uses: actions/setup-node@v4 with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c798e55..5acc967 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -56,7 +56,7 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false submodules: recursive @@ -116,7 +116,7 @@ jobs: - name: enable windows longpaths run: | git config --global core.longpaths true - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false submodules: recursive @@ -175,7 +175,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false submodules: recursive @@ -225,7 +225,7 @@ jobs: outputs: val: ${{ steps.host.outputs.manifest }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false submodules: recursive @@ -320,7 +320,7 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: persist-credentials: false submodules: recursive From aad90806026702600539517144e562d231315a0a Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 24 Jun 2026 02:40:12 +0000 Subject: [PATCH 2/2] ci: keep cargo-dist release.yml on checkout@v6, fix stale pin comments The actions/checkout v6->v7 bump broke the `dist plan` check: release.yml is generated by cargo-dist 0.32.0, which pins actions/checkout@v6. Bumping it to @v7 made `dist plan` fail with "out of date contents and needs to be regenerated". Revert release.yml's checkout pins to @v6 so it matches the generator (cargo-dist 0.32.0 has no support for emitting @v7). The hand-maintained workflows (ci.yml, publish-crates.yml, publish-npm.yml) were correctly bumped to the checkout v7.0.0 commit SHA, but dependabot left the trailing comment as `# v4.2.2`. Correct it to `# v7.0.0` to match the SHA. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01UbkunWLbnrSNFCs9ybm1VM --- .github/workflows/ci.yml | 2 +- .github/workflows/publish-crates.yml | 2 +- .github/workflows/publish-npm.yml | 2 +- .github/workflows/release.yml | 10 +++++----- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index babdbb3..ac2089b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,7 +18,7 @@ jobs: name: ci runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4.2.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # master with: diff --git a/.github/workflows/publish-crates.yml b/.github/workflows/publish-crates.yml index 7bdd0e8..7b95ce4 100644 --- a/.github/workflows/publish-crates.yml +++ b/.github/workflows/publish-crates.yml @@ -15,7 +15,7 @@ jobs: publish-crates: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4.2.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # master diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml index 6b55109..1e9f3dc 100644 --- a/.github/workflows/publish-npm.yml +++ b/.github/workflows/publish-npm.yml @@ -36,7 +36,7 @@ jobs: permissions: id-token: write steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4.2.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@v6 with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5acc967..c798e55 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -56,7 +56,7 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive @@ -116,7 +116,7 @@ jobs: - name: enable windows longpaths run: | git config --global core.longpaths true - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive @@ -175,7 +175,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive @@ -225,7 +225,7 @@ jobs: outputs: val: ${{ steps.host.outputs.manifest }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive @@ -320,7 +320,7 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@v6 with: persist-credentials: false submodules: recursive