diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 02bd1aa..6b95666 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,6 +6,8 @@ updates: # Python dependencies - package-ecosystem: "pip" directory: "/" + # PRs go to develop, per the branching strategy in CLAUDE.md + target-branch: "develop" schedule: interval: "weekly" day: "monday" @@ -36,6 +38,8 @@ updates: # GitHub Actions - package-ecosystem: "github-actions" directory: "/" + # PRs go to develop, per the branching strategy in CLAUDE.md + target-branch: "develop" schedule: interval: "weekly" day: "monday" @@ -53,6 +57,8 @@ updates: # Docker - package-ecosystem: "docker" directory: "/deploy" + # PRs go to develop, per the branching strategy in CLAUDE.md + target-branch: "develop" schedule: interval: "weekly" day: "monday" @@ -70,6 +76,8 @@ updates: # Cloudflare Workers (npm) - package-ecosystem: "npm" directory: "/workers" + # PRs go to develop, per the branching strategy in CLAUDE.md + target-branch: "develop" schedule: interval: "weekly" day: "monday" diff --git a/.github/workflows/auto-dev-bump.yml b/.github/workflows/auto-dev-bump.yml index 1f478ce..8840163 100644 --- a/.github/workflows/auto-dev-bump.yml +++ b/.github/workflows/auto-dev-bump.yml @@ -25,7 +25,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: fetch-depth: 0 token: ${{ secrets.RELEASE_PAT }} diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml index 76c6e6b..606ef53 100644 --- a/.github/workflows/auto-release.yml +++ b/.github/workflows/auto-release.yml @@ -28,7 +28,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: fetch-depth: 0 # Use PAT to bypass branch protection rules diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 524f8eb..b56e3f7 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -24,6 +24,12 @@ jobs: actions: read steps: + # Pinned to v6 deliberately: this job runs on pull_request_target for + # fork PRs and checks out the PR head, which checkout v7 blocks outright + # (actions/checkout#2454). Bumping this step disables fork-PR review. + # The block exists because checking out fork code in a + # pull_request_target job that holds secrets and contents: write is a + # privilege-escalation shape; revisit the fork lane rather than the pin. - name: Checkout repository uses: actions/checkout@v6 with: diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 7b6ecdd..992d399 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -26,7 +26,7 @@ jobs: actions: read steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: fetch-depth: 1 @@ -50,7 +50,7 @@ jobs: id-token: write steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: fetch-depth: 1 @@ -92,7 +92,7 @@ jobs: id-token: write steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: fetch-depth: 1 diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index af426d7..49429af 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -34,7 +34,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Initialize CodeQL uses: github/codeql-action/init@v4 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b73675a..cce66e8 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -20,7 +20,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Initialize CodeQL uses: github/codeql-action/init@v4 diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml index 55fe4fc..0593e22 100644 --- a/.github/workflows/codespell.yml +++ b/.github/workflows/codespell.yml @@ -18,7 +18,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Annotate locations with typos uses: codespell-project/codespell-problem-matcher@v1 - name: Codespell diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index 9a0d8d8..fe422df 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -22,7 +22,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Build Docker image for testing run: | @@ -81,14 +81,14 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Set up Docker Buildx uses: docker/setup-buildx-action@v4 - name: Log in to GitHub Container Registry if: github.event_name != 'pull_request' - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} @@ -96,7 +96,7 @@ jobs: - name: Extract metadata (tags, labels) id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | diff --git a/.github/workflows/process-feedback.yml b/.github/workflows/process-feedback.yml index fa9d3f2..86854bb 100644 --- a/.github/workflows/process-feedback.yml +++ b/.github/workflows/process-feedback.yml @@ -24,7 +24,7 @@ jobs: contents: read steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 2 # Get previous commit to detect new files diff --git a/.github/workflows/publish-testpypi.yml b/.github/workflows/publish-testpypi.yml index 5e1f6ab..112f368 100644 --- a/.github/workflows/publish-testpypi.yml +++ b/.github/workflows/publish-testpypi.yml @@ -19,7 +19,7 @@ jobs: version: ${{ steps.get_version.outputs.version }} should_publish: ${{ steps.check.outputs.should_publish }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 2 @@ -55,7 +55,7 @@ jobs: if: needs.check-version.outputs.should_publish == 'true' runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Set up Python uses: actions/setup-python@v6 diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index f551a51..672c37d 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -22,7 +22,7 @@ jobs: name: Build distribution runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Set up Python uses: actions/setup-python@v6 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a9a7b9a..8d83604 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,7 +15,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: fetch-depth: 0 diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index 34dff07..dfbf9b9 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -23,10 +23,10 @@ jobs: continue-on-error: true steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Dependency Review - uses: actions/dependency-review-action@v4 + uses: actions/dependency-review-action@v5 with: fail-on-severity: moderate comment-summary-in-pr: always @@ -37,7 +37,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Set up Python uses: actions/setup-python@v6 @@ -73,7 +73,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Build Docker image run: | @@ -118,7 +118,7 @@ jobs: if: github.event_name == 'pull_request' steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: fetch-depth: 0 # Full history for better detection diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index a9d2e7f..e945bb0 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -12,7 +12,7 @@ jobs: name: Lint & Format runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Set up Python uses: actions/setup-python@v6 @@ -40,7 +40,7 @@ jobs: python-version: ['3.12'] steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v6 @@ -77,7 +77,7 @@ jobs: pytest tests/ -v -m "not integration" --cov=src --cov-report=xml:coverage-unit.xml --cov-report=term-missing - name: Upload coverage to Codecov - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@v7 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage-unit.xml @@ -93,7 +93,7 @@ jobs: outputs: integration_needed: ${{ steps.changes.outputs.integration_needed }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: fetch-depth: 0 @@ -143,7 +143,7 @@ jobs: needs.check-changes.outputs.integration_needed == 'true' steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Set up Python uses: actions/setup-python@v6 @@ -173,7 +173,7 @@ jobs: - name: Upload standalone coverage to Codecov if: always() - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@v7 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage-standalone.xml @@ -193,7 +193,7 @@ jobs: (needs.check-changes.outputs.integration_needed == 'true' || github.event_name == 'workflow_dispatch') steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - name: Set up Python uses: actions/setup-python@v6 @@ -224,7 +224,7 @@ jobs: - name: Upload integration coverage to Codecov if: always() - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@v7 with: token: ${{ secrets.CODECOV_TOKEN }} files: ./coverage-integration.xml diff --git a/.github/workflows/update-hed-docs.yml b/.github/workflows/update-hed-docs.yml index ae2c8d1..e0d35fc 100644 --- a/.github/workflows/update-hed-docs.yml +++ b/.github/workflows/update-hed-docs.yml @@ -14,7 +14,7 @@ jobs: name: Fetch Latest HED Docs runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 with: ref: develop token: ${{ secrets.RELEASE_PAT }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 97e76fd..4fef161 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,16 @@ This file starts at 0.7.11. Earlier releases are described in the [GitHub releases](https://github.com/Annotation-Garden/HEDit/releases), which are generated from the commit log. +## [Unreleased] + +### Changed + +- CI actions moved to their current majors: `actions/checkout` v7, `codecov/codecov-action` + v7, `actions/dependency-review-action` v5, `docker/login-action` v4, + `docker/metadata-action` v6. The fork-PR review lane stays on `checkout` v6, the last + version that permits checking out a fork PR head under `pull_request_target`. Dependabot + now opens its PRs against develop rather than main. (#131, #133, #143, #152, #153) + ## [0.7.11] - 2026-08-20 The LLM provider migration, plus token and cache accounting on every surface, and extended