chore(ci): bump actions/setup-python from 6 to 7 - #785
Conversation
dependabot
Bot
added
the
no-changeset
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
the
no-changeset
1594271 to
eea4e03
Compare
miravoss26
left a comment
miravoss26
left a comment
There was a problem hiding this comment.
Mechanical bump: actions/setup-python v6 → v7 in both optimizer-release.yml and test.yml. No behavior change beyond the action's own internals (dependabot's release notes show an ESM migration + SHA-pinned deps upstream, nothing that touches how this repo calls it). CI green on both workflows.
Safe to merge from my read.
eea4e03 to
937b974
Compare
miravoss26
left a comment
miravoss26
left a comment
There was a problem hiding this comment.
Routine dependabot bump: actions/setup-python v6 → v7 across two workflow files (optimizer-release.yml, test.yml). Official GitHub Action, no functional change to the pipelines beyond the pinned version, CI already green on the bump itself.
Safe to merge from my read.
|
Noticed I reviewed this twice (02:10 and 06:16 UTC) — the dedup ledger missed that the first review already landed at this same head. Both say the same thing: safe to merge from my read. Looking into why the ledger didn't catch it. |
937b974 to
f202635
Compare
miravoss26
left a comment
miravoss26
left a comment
There was a problem hiding this comment.
CI-only bump: actions/setup-python v6 → v7 in two workflow files (optimizer-release.yml, test.yml), both pinned to the pip cache path for Python 3.12. v7's changelog is mostly an ESM migration + manifest-fetch hardening; no input FTW's workflows use was removed.
Security screen: no secrets, no new network destinations, action pin is a tag not a SHA (matches the existing convention in these files — not a regression). CI green. Safe to merge from my read.
f202635 to
2b6ece2
Compare
2b6ece2 to
608ab9c
Compare
|
The v6 to v7 change is narrow and its current PR checks are green. I am leaving it open for now because #735 already owns Once #735 is rebased or its workflow ownership is split out, refresh this branch and rerun the same checks. |
miravoss26
left a comment
miravoss26
left a comment
There was a problem hiding this comment.
Mechanical CI bump: actions/setup-python v6 → v7 across optimizer-release.yml and test.yml, nothing else touched. Dependabot-authored, all checks green, no secrets/injection/authz/new-dependency surface to flag.
Safe to merge from my read.
608ab9c to
b992ce6
Compare
miravoss26
left a comment
miravoss26
left a comment
There was a problem hiding this comment.
Dependabot: actions/setup-python v6 → v7 in optimizer-release.yml (×2) and test.yml. Pure version bump, no logic change, all 15 checks green.
- No new deps, no secrets, no injection surface — a GitHub Actions version pin.
- v7 release notes (ESM migration, manifest fetch validation) don't touch anything this repo configures.
Safe to merge from my read.
40899cf to
5b7b9dc
Compare
5b7b9dc to
1bfabd3
Compare
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@v6...v7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
1bfabd3 to
b2a8031
Compare
miravoss26
left a comment
miravoss26
left a comment
There was a problem hiding this comment.
Re-reviewed after another rebase (this one's been reviewed 5 times now — ftw's main moves daily, so dependabot keeps re-basing without new content, and each rebase gets a fresh head sha). Diff is still the same 3-line actions/setup-python@v6 → @v7 bump across optimizer-release.yml and test.yml, no other changes.
Security screen: clean — official GitHub Actions action, major-version bump but no workflow-permission or trigger changes, no new secrets. All 14 checks green.
Safe to merge from my read, same verdict as before. ftw isn't on my auto-merge allowlist — worth merging soon on your end so it stops re-triggering a review every time main moves.
2 participants
Bumps actions/setup-python from 6 to 7.
Release notes
Sourced from actions/setup-python's releases.
... (truncated)
Commits
5fda3b9Pin SHA commits and update docs with latest versions (#1338)4ab7e95Merge pull request #1337 from actions/philip-gai/bump-actions-cache-6-2-00f3a009Remove the pip-install input (#1336)f8cf429Migrate to ESM and upgrade dependencies (#1330)54baeeaValidate and retry manifest fetch to prevent silent failures (#1332)c709277Annotation code fix (#1335)6849080remove EOL Python versions and Bumps numpy text fixture (#1333)0903b46Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data (#1328)