Bump CI actions to current majors, point dependabot at develop - #168
Merged
Conversation
Applies the five stale dependabot proposals (#131, #133, #143, #152, #153), all of which are still the current majors: checkout v7, codecov-action v7, dependency-review-action v5, docker/login-action v4, docker/metadata-action v6. Every one is a Node 24 runtime bump; the only behavioral change that touches this repo is checkout v7 refusing to check out a fork PR head under pull_request_target, so the claude-code-review fork lane stays on v6 with a comment explaining why. Dependabot now targets develop, matching the branching strategy, so its future PRs stop landing on main. Tested: 559 unit tests pass; all 16 workflow YAML files parse.
This was referenced Aug 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears five of the six stale dependabot PRs. All of them proposed the current major, so nothing needed rebasing, only applying:
actions/checkoutcodecov/codecov-actionactions/dependency-review-actiondocker/login-actiondocker/metadata-actionWhat actually changes
Every one of these majors is a Node 24 runtime bump, which GitHub-hosted runners already satisfy (runner >= 2.327.1). I read each release note for changes that touch how this repo calls them:
checkoutv7 blocks checking out a fork PR head underpull_request_targetorworkflow_run(actions/checkout#2454).claude-code-review.ymldoes exactly that, so bumping it would silently disable fork-PR review. That one step stays on v6 with a comment. Worth noting the block exists for a reason: that job holds secrets andcontents: writewhile checking out fork code, which is the classic privilege-escalation shape. The fix is to reconsider the fork lane, not the pin, so I left the lane alone rather than redesigning it here.metadata-actionv6 changed#handling in list inputs, preserving inline#while still supporting full-line comments.docker-build.ymlonly uses full-line comments in itstagslist, so it is unaffected.codecov-actionv5 to v7 carries no input changes;token,files,flags,name,fail_ci_if_error, andverboseall still apply.Dependabot now targets develop
All four ecosystems get
target-branch: "develop". Dependabot was opening PRs against main, which is why six of them accumulated unmerged: the branching strategy sends changes through develop, so nobody was going to merge them where they sat.The sixth PR
#134 (wrangler 4.71.0 to 4.94.0 in
/workers) is not included. Its proposal is stale by 30 minor versions (wrangler is at 4.125.0), and it carries apackage-lock.jsonupdate, which is dependabot's to maintain. With the config change above, dependabot will reopen it against develop at the current version.Verification
559 unit tests pass, all 16 workflow YAML files parse, and CI on this PR exercises the bumped
checkout,codecov-action, anddependency-review-actiondirectly.