ci(deps): Bump the github-actions group with 2 updates#40
Conversation
Bumps the github-actions group with 2 updates: [pnpm/action-setup](https://github.com/pnpm/action-setup) and [github/codeql-action](https://github.com/github/codeql-action). Updates `pnpm/action-setup` from 6.0.5 to 6.0.7 - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@8912a91...739bfe4) Updates `github/codeql-action` from 4.35.3 to 4.35.4 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e46ed2c...68bde55) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-version: 6.0.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — Dependabot patch bumps for two GitHub Actions, SHA-pinned with no workflow logic changes.
Extended reasoning...
Overview
This PR is a Dependabot grouped update that bumps two GitHub Actions to patch releases:
pnpm/action-setupfrom v6.0.5 → v6.0.7 (4 usages in.github/workflows/ci.yml)github/codeql-actionfrom v4.35.3 → v4.35.4 (init + analyze in.github/workflows/codeql.yml)
Both actions remain pinned by full commit SHA with the version as a trailing comment. No workflow logic, inputs, or permissions are touched.
Security risks
None of note. SHA pinning is preserved, so the upgrade is to specific immutable commits. The pnpm/action-setup release notes describe bug fixes (honor devEngines.packageManager.onFail=error, restore inputs from state in post, self-update bootstrap fix). The codeql-action release only bumps the default CodeQL bundle to 2.25.4. Neither release introduces breaking behavior relevant to this repository.
Level of scrutiny
Low. This is a routine third-party Action patch bump with SHA pinning — exactly the kind of mechanical change suitable for auto-approval. The diff is six identical line replacements across two workflow files.
Other factors
No bugs were flagged by the bug hunting system, no outstanding reviewer comments, and the prior PRs in this repo (e.g., #38, #34, #32) follow the same Dependabot-bump pattern. CI on this PR will exercise the new pnpm action across the lint/test/dist/schema/e2e jobs.
|
| Experiment | Status | Actions |
|---|---|---|
| Uppercase (py) | ✅ Pass | View GitHub Action Run · View in Langfuse |
| Uppercase (ts) | ✅ Pass | View GitHub Action Run · View in Langfuse |
| Mixed dir (node) | ✅ Pass | View GitHub Action Run · View in Langfuse |
| Mixed dir (python) | ✅ Pass | View GitHub Action Run · View in Langfuse |
| Regression fixture | ❌ Regression | View GitHub Action Run · View in Langfuse |
Details
1 participant
Bumps the github-actions group with 2 updates: pnpm/action-setup and github/codeql-action.
Updates
pnpm/action-setupfrom 6.0.5 to 6.0.7Release notes
Sourced from pnpm/action-setup's releases.
Commits
739bfe4fix: self-update bootstrap to packageManager-pinned version (#233) (#256)f61705dchore: add CODEOWNERS7a5507bfix: restore inputs from state in post (#255)1155470fix: honor devEngines.packageManager.onFail=error (#252) (#254)91ab88efix: bin_dest output points to self-updated pnpm, not bootstrap (#249)e578e19fix: update pnpm to 11.0.4Updates
github/codeql-actionfrom 4.35.3 to 4.35.4Release notes
Sourced from github/codeql-action's releases.
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
68bde55Merge pull request #3885 from github/update-v4.35.4-803d9e8c39739ad2Update changelog for v4.35.4803d9e8Merge pull request #3883 from github/mbg/test/macro-wrapper0fd9c7dMerge pull request #3882 from github/dependabot/github_actions/dot-github/wor...922d6fbUsemakeMacroinstead oftest.macrodf77e87Update test macro snippet6e3f985Add wrapper fortest.macroe7a347dMerge pull request #3881 from github/update-bundle/codeql-bundle-v2.25.417eabb2Rebuildaaef09cBump ruby/setup-rubyDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions