Repository navigation
ci: Bump the gh-actions group with 7 updates - #420
Merged
Oliver Borchert (borchero) merged 1 commit intoNov 1, 2026
Merged
Oliver Borchert (borchero) merged 1 commit into
Oliver Borchert (borchero) merged 1 commit into
Conversation
Bumps the gh-actions group with 7 updates: | Package | From | To | | --- | --- | --- | | [prefix-dev/setup-pixi](https://github.com/prefix-dev/setup-pixi) | `0.10.2` | `0.11.2` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `7.0.1` | `7.0.2` | | [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.2` | `1.14.3` | | [release-drafter/release-drafter/autolabeler](https://github.com/release-drafter/release-drafter) | `7.7.0` | `7.10.0` | | [Swatinem/rust-cache](https://github.com/swatinem/rust-cache) | `2.9.2` | `2.9.3` | | [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) | `7.7.0` | `7.10.0` | | [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) | `4.39.0` | `4.39.1` | Updates `prefix-dev/setup-pixi` from 0.10.2 to 0.11.2 - [Release notes](https://github.com/prefix-dev/setup-pixi/releases) - [Commits](prefix-dev/setup-pixi@v0.10.2...ad1da64) Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v7.0.1...cf430e0) Updates `pypa/gh-action-pypi-publish` from 1.14.2 to 1.14.3 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@dc37677...7245906) Updates `release-drafter/release-drafter/autolabeler` from 7.7.0 to 7.10.0 - [Release notes](https://github.com/release-drafter/release-drafter/releases) - [Commits](release-drafter/release-drafter@34d8067...978bb0b) Updates `Swatinem/rust-cache` from 2.9.2 to 2.9.3 - [Release notes](https://github.com/swatinem/rust-cache/releases) - [Changelog](https://github.com/Swatinem/rust-cache/blob/master/CHANGELOG.md) - [Commits](Swatinem/rust-cache@6323deb...d1527c8) Updates `release-drafter/release-drafter` from 7.7.0 to 7.10.0 - [Release notes](https://github.com/release-drafter/release-drafter/releases) - [Commits](release-drafter/release-drafter@34d8067...978bb0b) Updates `github/codeql-action/upload-sarif` from 4.39.0 to 4.39.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@6f2ac81...9b32540) --- updated-dependencies: - dependency-name: prefix-dev/setup-pixi dependency-version: 0.11.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gh-actions - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gh-actions - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gh-actions - dependency-name: release-drafter/release-drafter/autolabeler dependency-version: 7.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gh-actions - dependency-name: Swatinem/rust-cache dependency-version: 2.9.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gh-actions - dependency-name: release-drafter/release-drafter dependency-version: 7.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: gh-actions - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.39.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: gh-actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
github_actions
dependabot
Bot
requested review from
Andreas Albert (AndreasAlbertQC),
Oliver Borchert (borchero) and
Daniel Elsner (delsner)
as code owners
November 1, 2026 11:38
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The GitHub Actions dependency updates have no active review issues.
No open issues 🎉
What changed in this PR
Updates seven GitHub Actions dependencies used by Dataframely’s CI and release automation, retaining commit-SHA pinning. No application code or workflow logic changes.
Changes:
- Updates Pixi setup and Rust caching actions.
- Updates artifact upload and PyPI publishing actions.
- Updates release drafting, PR autolabeling, and code-scanning upload actions.
| File | Description |
|---|---|
.github/workflows/scorecard.yml |
Updates CodeQL SARIF upload to v4.39.1. |
.github/workflows/release-drafter.yml |
Updates Release Drafter to v7.10.0. |
.github/workflows/nightly.yml |
Updates Pixi setup to v0.11.2. |
.github/workflows/copilot-setup-steps.yml |
Updates Pixi setup and Rust caching. |
.github/workflows/ci.yml |
Updates Rust caching to v2.9.3 in both jobs. |
.github/workflows/chore.yml |
Updates PR autolabeling to v7.10.0. |
.github/workflows/build.yml |
Updates Pixi setup, artifact upload, and PyPI publishing. |
Review effort: Balanced
Oliver Borchert (borchero)
approved these changes
Nov 1, 2026
Oliver Borchert (borchero)
deleted the
dependabot/github_actions/gh-actions-aa8c816f6c
branch
November 1, 2026 23:00
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the gh-actions group with 7 updates:
0.10.20.11.27.0.17.0.21.14.21.14.37.7.07.10.02.9.22.9.37.7.07.10.04.39.04.39.1Updates
prefix-dev/setup-pixifrom 0.10.2 to 0.11.2Release notes
Sourced from prefix-dev/setup-pixi's releases.
Commits
ad1da64fix(deps): bump undici, brace-expansion and handlebars (#295)05a7f7afix: Don't delete preinstalled pixi bin in cleanup (#297)f549d46ci: use pixi exec instead of choco to install yq (#294)4578022docs: Adjust workload-identity-audience section (#293)a2789fefeat: Add auth-workload-identity inputs for OIDC login (#292)9dabb60feat!: Add auth-logout input and run pixi auth status after login (#291)5fdf4c6chore: bump typescript to v7 and migrate to oxlint and oxfmt (#289)1fa34b6chore(deps): bump the nodejs group across 1 directory with 7 updates (#288)999d92achore(deps): bump the gh-actions group across 1 directory with 2 updates (#287)2a8a984chore: simplify example recipe (#285)Updates
actions/upload-artifactfrom 7.0.1 to 7.0.2Release notes
Sourced from actions/upload-artifact's releases.
Commits
cf430e0Merge pull request #822 from actions/tunc-d-prepare-upload-v7-0-2c2acdedchore: prepare v7.0.2 release4687c1bMerge pull request #821 from actions/tunc-d-upload-artifact-package-bump8cbe1beBump@actions/artifactto 6.3.1Updates
pypa/gh-action-pypi-publishfrom 1.14.2 to 1.14.3Release notes
Sourced from pypa/gh-action-pypi-publish's releases.
Commits
7245906Merge pull request #427 from sethmlarson/certifi-sigstore331eccbUpgrade certifi and sigstoref68fee4💰 Sync the FUNDING configc0d6f8eMerge branch 'integrity/runtime/deptree' into unstable/v19090099🧪 Make smoke test deps hash-pinned in CI34e40c2📌 Bump pip-tools managed transitive deptreese800ed5👷 Enable hash-checking in the runtime deptree 🔗dd8c5f4🔧 Make pip-tools config available in containerUpdates
release-drafter/release-drafter/autolabelerfrom 7.7.0 to 7.10.0Release notes
Sourced from release-drafter/release-drafter/autolabeler's releases.
... (truncated)
Commits
978bb0bchore: release v7.10.0 (#1828)7875ba4chore(deps): update dependency knip to 6.39.0 (#1830)cab3fb0chore(deps): update dependency@biomejs/biometo 2.5.15 (#1829)eea1614chore(deps): update vitest to 5.0.3 (#1827)c91bcd7chore(deps): lock file maintenance (#1826)9fece4etest: run GitLab conformance against GitLab CE 19.4.1 (#1825)f8732bftest: use the GitLab image that caches Mustermann's encoded characters (#1824)20ee3a7feat(check-pr): validate base and proposed configuration (#1809)4248c85fix(deps): update dependency@octokit/plugin-paginate-restto 16.0.0 (#1813)988dde1feat(replacers): select PR body sections by heading (#1808)Updates
Swatinem/rust-cachefrom 2.9.2 to 2.9.3Release notes
Sourced from Swatinem/rust-cache's releases.
Changelog
Sourced from Swatinem/rust-cache's changelog.
... (truncated)
Commits
d1527c82.9.3f0fca6fupdate dependencies and rebuildb49b17fadd missing awaits6a7bc3eBump the dev-minor group across 1 directory with 2 updates (#383)4ece996Bump the actions group across 1 directory with 6 updates (#392)8103affBump the prd-minor group across 1 directory with 2 updates (#389)0e361f3fix: log rustup toolchain list failure as info instead of warning (#393) (#394)f0d9c38Merge pull request #380 from Swatinem/dependabot/github_actions/actions-8ff58...ccd9742Bump the actions group with 2 updates258712bfix: stop cleanup timestamp pruning after the first entry (#377)Updates
release-drafter/release-drafterfrom 7.7.0 to 7.10.0Release notes
Sourced from release-drafter/release-drafter's releases.
... (truncated)
Commits
978bb0bchore: release v7.10.0 (#1828)7875ba4chore(deps): update dependency knip to 6.39.0 (#1830)cab3fb0chore(deps): update dependency@biomejs/biometo 2.5.15 (#1829)eea1614chore(deps): update vitest to 5.0.3 (#1827)c91bcd7chore(deps): lock file maintenance (#1826)9fece4etest: run GitLab conformance against GitLab CE 19.4.1 (#1825)f8732bftest: use the GitLab image that caches Mustermann's encoded characters (#1824)20ee3a7feat(check-pr): validate base and proposed configuration (#1809)4248c85fix(deps): update dependency@octokit/plugin-paginate-restto 16.0.0 (#1813)988dde1feat(replacers): select PR body sections by heading (#1808)Updates
github/codeql-action/upload-sariffrom 4.39.0 to 4.39.1Release notes
Sourced from github/codeql-action/upload-sarif's releases.
Changelog
Sourced from github/codeql-action/upload-sarif's changelog.
... (truncated)
Commits
9b32540Merge pull request #4257 from github/update-v4.39.1-c5a2f4b0fb5e1ed9Trigger workflows20f5ec3Update changelog for v4.39.1c5a2f4bMerge pull request #4245 from github/henrymercer/graduate-overlay-trap-caching61a5a80Merge pull request #4256 from github/update-bundle/codeql-bundle-v2.27.33dd33f8Merge pull request #4249 from github/mbg/upload-improvements-for-4223b96e339Change comment forgetConfigcall inupload-sarif7fa4518UseshouldSkipSarifUploadinanalyze-action.tsa69c7cbDocument that setting the env vars tofalsetakes precedence74ddcd9Fix typo in commentDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions