chore(deps): actions: bump the all-actions group with 3 updates#625
chore(deps): actions: bump the all-actions group with 3 updates#625dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the all-actions group with 3 updates: [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials), [withastro/action](https://github.com/withastro/action) and [github/issue-metrics](https://github.com/github/issue-metrics). Updates `aws-actions/configure-aws-credentials` from 6.2.1 to 6.2.2 - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](aws-actions/configure-aws-credentials@254c19b...517a711) Updates `withastro/action` from 6.1.1 to 6.1.2 - [Release notes](https://github.com/withastro/action/releases) - [Commits](withastro/action@b7d5362...e84f40b) Updates `github/issue-metrics` from 4.2.8 to 5.0.0 - [Release notes](https://github.com/github/issue-metrics/releases) - [Commits](github-community-projects/issue-metrics@44173f9...df8c49d) --- updated-dependencies: - dependency-name: aws-actions/configure-aws-credentials dependency-version: 6.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-actions - dependency-name: withastro/action dependency-version: 6.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-actions - dependency-name: github/issue-metrics dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
scottschreckengaust
left a comment
scottschreckengaust
left a comment
There was a problem hiding this comment.
Verdict
Approve. Clean, correctly SHA-pinned GitHub Actions bump. All three new pins verify against their upstream release tags, CI is green, and the one major bump (github/issue-metrics 4.2.8 -> 5.0.0) is an internal-only refactor that does not touch the action's input/output contract as we consume it.
Vision alignment
Supports the platform's operational-excellence and bounded/reviewable tenets: keeps the CI supply chain current while preserving immutable SHA pinning (the safe way to consume third-party actions). No control-plane or blast-radius impact. No ADR/RFC needed.
Blocking issues
None.
Version delta verification (done, not assumed)
Each uses: pin in the diff was checked against the upstream release tag via gh api .../git/ref/tags/<tag>:
| Action | Old -> New | New SHA in diff | Upstream tag SHA | Match |
|---|---|---|---|---|
aws-actions/configure-aws-credentials |
v6.2.1 -> v6.2.2 | 517a711 |
517a711dbcd0e402f90c77e7e2f81e849156e31d (v6.2.2) |
yes |
withastro/action |
v6.1.1 -> v6.1.2 | e84f40b |
e84f40bd8d2caa9e768ec82ad30dd81f0b280853 (v6.1.2) |
yes |
github/issue-metrics |
v4.2.8 -> v5.0.0 | df8c49d |
df8c49d20958f9345281fa2124858bd0ad227e1f (v5.0.0) |
yes |
Comment tags on each line match the resolved version. configure-aws-credentials v6.2.2 is a chore/release patch (no functional change). withastro/action v6.1.2 only bumps its internal tool versions (PNPM/Node/Deno/cache).
The one major bump: github/issue-metrics 5.0.0
The breaking change in 5.0.0 is a purely internal migration (github3.py -> PyGithub) - it does not change the action's public interface. Verified against our usage in .github/workflows/monthly-repo-metrics.yml:
- We drive the action only via
env: GH_TOKENandenv: SEARCH_QUERY, and consume the default output fileissue_metrics.md. - The v5.0.0 README still documents
GH_TOKEN(required),SEARCH_QUERY(required), and defaultOUTPUT_FILE: issue_metrics.md- identical to how we call it; the v5 sample workflow is the same shape as ours. SEARCH_QUERYuses standard GitHub search syntax (repo:,is:issue,-reason:,is:pr,-is:draft) which PyGithub honors the same way.- Blast radius is minimal regardless: this is a scheduled/
workflow_dispatch-only monthly reporting job, not on the deploy/test critical path.
Note: .github/dependabot.yml groups these under all-actions with no ignore: version-update:semver-major restriction for that group, so this major bump is permitted by config (the semver-major ignores at lines 47/70 apply to other ecosystems).
Non-blocking suggestions / nits
github/issue-metricscrossed a major version silently inside a grouped Dependabot PR. That is fine here given the internal-only nature, but for grouped major bumps in general it is worth a human eyeball on the changelog before merge (as done here). No action needed.
Documentation
No docs impact. CI action version bumps do not touch docs/guides/, docs/design/, ADRs, or the Starlight mirror. No mirror-sync required. No dependabot.yml drift.
Tests & CI
CI green: build (agentcore) pass, Secrets, deps, and workflow scan pass, Dead-code detection (advisory) pass, Validate PR title pass. auto-approve/CodeQL skipping (expected for this path). No CDK construct/stack changes -> bootstrap synth-coverage not applicable. No unit tests required or expected for a workflow-only SHA bump; the workflows themselves are the executable surface and are exercised by CI.
Review agents run
- /security-review - RAN. GitHub Actions changes touch the CI supply-chain/secrets boundary. Result: 0 high-confidence findings. SHA pinning preserved on all three actions; no new trigger surface (
monthly-repo-metrics.ymlstaysschedule/workflow_dispatch); no change to secret flow (AWS_ROLE_TO_ASSUME,GITHUB_TOKEN,github.token) or permissions blocks. - code-reviewer - OMITTED: no application source changed (YAML workflow pins only); style/guideline scope not touched.
- silent-failure-hunter - OMITTED: no error-handling/fallback code in the diff.
- type-design-analyzer - OMITTED: no new/changed types.
- comment-analyzer - OMITTED: the only comments are the
# vX.Y.Zpin tags, which were verified accurate against the resolved SHAs above. - pr-test-analyzer - OMITTED: no testable code units; N/A for a workflow dependency bump.
Human heuristics
- Proportionality - Pass. Minimal 6-line diff; no new abstraction.
- Coherence - Pass. Every
uses:pin follows the repo's established@<40-char-sha> # vX.Y.Zconvention; consistent across all four files. - Clarity - Pass. Version comment tags accurately name the resolved release for each SHA.
- Appropriateness - Pass. Maintainable and standard Dependabot flow; the major bump was verified against the real upstream README/changelog (AI001), not assumed.
1 participant
Bumps the all-actions group with 3 updates: aws-actions/configure-aws-credentials, withastro/action and github/issue-metrics.
Updates
aws-actions/configure-aws-credentialsfrom 6.2.1 to 6.2.2Release notes
Sourced from aws-actions/configure-aws-credentials's releases.
Changelog
Sourced from aws-actions/configure-aws-credentials's changelog.
... (truncated)
Commits
517a711chore(main): release 6.2.2 (#1876)d01d678chore: release 6.2.28efa52bchore(deps-dev): bump vitest dependencies (#1874)8e1eed5chore(deps-dev): bump@smithy/property-providerfrom 4.4.4 to 4.4.6 (#1869)112421achore(deps-dev): bump@biomejs/biomefrom 2.5.1 to 2.5.2 (#1868)fbc01c6chore(deps-dev): bump@types/nodefrom 26.0.1 to 26.1.0 (#1871)b12ca87chore(deps-dev): bump memfs from 4.57.8 to 4.58.0 (#1873)d314f7fchore: Update dista53b65bchore(deps): bump@aws-sdk/client-stsfrom 3.1076.0 to 3.1080.0 (#1867)338d2c1chore(deps-dev): bump sigstore from 4.1.0 to 4.1.1 (#1864)Updates
withastro/actionfrom 6.1.1 to 6.1.2Release notes
Sourced from withastro/action's releases.
Commits
e84f40bchore: update action versions for PNPM, Node, Deno, and cache (#105)Updates
github/issue-metricsfrom 4.2.8 to 5.0.0Release notes
Sourced from github/issue-metrics's releases.
Commits
df8c49drefactor: migrate from github3.py to PyGithub (#789)0241b11chore(deps): bump the dependencies group with 4 updates (#788)dba1789chore(deps): bump python from63a4c7ftob877e50(#786)2c2cef3chore(deps): bump pytest from 9.1.0 to 9.1.1 in the dependencies group (#787)92b54efchore(deps): bump python from44dd044to63a4c7f(#781)172961bchore(deps): bump the dependencies group with 2 updates (#782)afbd9f7chore(deps): bump github-community-projects/contributors (#783)74a065achore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#784)c4559e3chore(deps): bump python in the dependencies group (#780)12aa671chore(deps): bump cryptography from 46.0.7 to 48.0.1 (#778)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions