From 23506841332c33b9a06d67f46f572bf7362898e5 Mon Sep 17 00:00:00 2001 From: basi Date: Tue, 29 Sep 2026 15:47:28 +0900 Subject: [PATCH] build(deps): bump github-tag-action to v7 and pin actions to SHAs Supersede Dependabot PR #28 (mathieudutour/github-tag-action 6.2 -> 7) and pin every action in the Bump version workflow to a full-length commit SHA, keeping the resolved release tag as a trailing comment so Dependabot can keep updating it: - actions/checkout v7 -> 3d3c42e5aac5ba805825da76410c181273ba90b1 (v7.0.1) - mathieudutour/github-tag-action v6.2 -> af99e60ce8132224b8e6ebab5023449fe256ed46 (v7.0.0) - ncipollo/release-action v1 -> 339a81892b84b4eeb0f6e744e4574d79d0d9b8dd (v1.21.0) A moved or hijacked tag can no longer change the code that runs with the repository token. github-tag-action v7 targets Node 24, which removes the Node 20 deprecation warning from every run, and keeps the inputs and outputs this workflow uses (github_token, default_bump, custom_tag, new_tag, changelog). Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/bump-version.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml index dc7179f0de..e304996aaa 100644 --- a/.github/workflows/bump-version.yml +++ b/.github/workflows/bump-version.yml @@ -8,16 +8,16 @@ jobs: name: Bump version runs-on: ubuntu-latest steps: - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Bump version and push tag id: tag_version - uses: mathieudutour/github-tag-action@v6.2 + uses: mathieudutour/github-tag-action@af99e60ce8132224b8e6ebab5023449fe256ed46 # v7.0.0 with: github_token: ${{ secrets.GITHUB_TOKEN }} default_bump: patch custom_tag: 1.2.0 - name: Create a GitHub release - uses: ncipollo/release-action@v1 + uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0 with: tag: ${{ steps.tag_version.outputs.new_tag }} name: Release ${{ steps.tag_version.outputs.new_tag }}