Conversation
dependabot
Bot
added
dependencies
Bumps [mozilla-actions/sccache-action](https://github.com/mozilla-actions/sccache-action) from 0.0.9 to 0.0.10. - [Release notes](https://github.com/mozilla-actions/sccache-action/releases) - [Commits](Mozilla-Actions/sccache-action@7d986dd...9e7fa8a) --- updated-dependencies: - dependency-name: mozilla-actions/sccache-action dependency-version: 0.0.10 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/mozilla-actions/sccache-action-0.0.10
branch
from
1e0e64b to
3e608e6
Compare
potiuk
left a comment
potiuk
left a comment
There was a problem hiding this comment.
verify-action-build flagged this as the same class of problem we hit in #669 (SonarSource/sonarqube-scan-action 7.0.0 → 7.1.0): the committed dist/ at v0.0.10 only matches a clean rebuild when package.json + package-lock.json are swapped back to the v0.0.9 commit. In other words the upstream release commit bumped the lockfile version strings but shipped a dist/ that was built against the previous toolchain. Source changes between versions look clean — no suspicious behaviour introduced — so the underlying bump itself is fine to accept, as we did for #669.
Unlike #669 (where SonarSource had issues/PRs disabled so we couldn't report it), Mozilla's repo accepts PRs, so I opened an upstream CI-hardening PR to prevent this recurring on future releases:
The proposed fix adds a verify-dist job that runs npm ci && npm run build on Node 24 (matching action.yml's using: node24) and fails if the committed dist/ differs from a clean rebuild — catching this kind of drift at the release-repo CI rather than downstream in verify-action-build.
Conditionally approving on the same basis as #669, but would like a second pair of eyes before merge.
Generated-by: Claude Opus 4.7 (1M context)
dave2wave
deleted the
dependabot/github_actions/dot-github/actions/for-dependabot-triggered-reviews/mozilla-actions/sccache-action-0.0.10
branch
2 participants
Bumps mozilla-actions/sccache-action from 0.0.9 to 0.0.10.
Release notes
Sourced from mozilla-actions/sccache-action's releases.
Commits
9e7fa8aMerge pull request #251 from sylvestre/ver3ca012dprepare version 0.0.107cf1643Merge pull request #231 from Mozilla-Actions/dependabot/npm_and_yarn/js-yaml-...b2be802Merge pull request #246 from baseplate-admin/patch-184812a5Merge pull request #250 from Mozilla-Actions/dependabot/npm_and_yarn/handleba...4e28318Merge pull request #249 from Mozilla-Actions/dependabot/npm_and_yarn/picomatc...cfa813eMerge pull request #248 from Mozilla-Actions/dependabot/npm_and_yarn/flatted-...ef3762bMerge pull request #245 from cakebaker/bump_to_node24919bfb6Bump handlebars from 4.7.8 to 4.7.9167904bBump picomatch from 2.3.1 to 2.3.2