Repository navigation
Pin actions, add Dependabot version updates, refresh dependencies - #33
Merged
Merged
Conversation
A tag like @v2 is a pointer its owner can move, and release.yml runs these actions beside the signing secrets. A commit SHA cannot be moved. The version stays in a trailing comment so a reader and Dependabot can both see what it is. dtolnay/rust-toolchain chooses its toolchain from the ref it is called at, so pinning the ref would have silently dropped the choice; it is now stated with toolchain: stable. GitHub-owned actions stay on tags. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Security updates were already on and need no file. This adds weekly updates for the three ecosystems — Cargo, the site's pnpm dependencies, and GitHub Actions — grouped so a week is one pull request each rather than a stream. A seven-day cooldown applies to routine bumps only: a release published today may be one a maintainer's account was used to push a minute ago, and waiting lets a compromised version be yanked before it arrives. Security updates ignore the cooldown. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
cargo update, including time 0.3.47 for the open advisory. time is in the lockfile but no target compiles it, so nothing changes at runtime; its newer crates declare Rust 1.88 against this crate's 1.85, which is why it stayed put until forced. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
pnpm update, then check and audit: typecheck, lint, format and the prerendered build pass and pnpm audit reports nothing. @types/node stays on 24 rather than jumping to 26. Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Swatinem/rust-cache,dtolnay/rust-toolchain,pnpm/setup); GitHub-owned ones stay on tags.release.ymlruns these beside the signing secrets, and a tag can be moved by its owner.rust-toolchainpicks its toolchain from the ref, so it now saystoolchain: stableexplicitly.dependabot.yml: weekly, grouped, for Cargo,/website(pnpm) and GitHub Actions, with a 7-day cooldown on routine bumps. Security updates are unaffected and ignore it.cargo update(344 tests, clippy 1.99 pass) andpnpm update(check +pnpm auditclean).Worth knowing
The open
timeadvisory is cleared (0.3.47) buttimeis in the lockfile only: no target compiles it. Its newer crates declare Rust 1.88 against this crate's 1.85, socargo updatealone had left it; I forced it with--precise. Nothing changes at runtime. If you would rather keep the lockfile MSRV-clean, drop that commit and dismiss the alert as not reachable.Still yours: enable secret scanning and push protection in Settings → Code security.
🤖 Generated with Claude Code