Bump peaceiris/actions-gh-pages from 3.8.0 to 3.9.0 by dependabot[bot] · Pull Request #73 · DiamondLightSource/python3-pip-skeleton

dependabot · 2022-10-24T17:17:55Z

Bumps peaceiris/actions-gh-pages from 3.8.0 to 3.9.0.

Release notes

Sourced from peaceiris/actions-gh-pages's releases.

actions-github-pages v3.9.0

deps: bump node12 to node16

deps: bump @actions/core from 1.6.0 to 1.10.0

See CHANGELOG.md for more details.

Changelog

Sourced from peaceiris/actions-gh-pages's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

3.9.0 (2022-10-23)

chore

add duplicate (402af2b)

Convert templates to YAML issue forms (ecd92e3)

Disable Bug Report (55635e9)

Fix prettier (#633) (fde6b18), closes #633

fix title (b5022f9)

Fix workflow name (e91a189)

fix year (f2ac8b6)

improve Check list (6a30129)

Improve checklist (69f1241)

Set required to false (d7ab6de)

Set required to false (e8cba38)

update year from 2020 to 2022 (f1f4f15)

ci

add actions/dependency-review-action (3cc0a55)

Add concurrency (edb4f3e)

bump actions/checkout from 2 to 2.3.4 (#610) (3102151), closes #610

bump actions/checkout from 2.3.4 to 2.3.5 (#664) (b19f8b8), closes #664

bump actions/checkout from 2.3.5 to 2.4.0 (#668) (d3d121d), closes #668

bump actions/checkout from 2.4.0 to 3 (#715) (c921422), closes #715

bump actions/dependency-review-action from 1 to 2 (#762) (1304921), closes #762

bump actions/labeler from 3 to 4 (#716) (7954f3d), closes #716

bump actions/setup-node from 2.1.5 to 2.2.0 (#626) (3edcc53), closes #626

bump actions/setup-node from 2.2.0 to 2.3.0 (#632) (69191bf), closes #632

bump actions/setup-node from 2.3.0 to 2.3.1 (#636) (d5e7428), closes #636

bump actions/setup-node from 2.3.1 to 2.3.2 (#637) (4a55c45), closes #637

bump actions/setup-node from 2.3.2 to 2.4.0 (#639) (288fd14), closes #639

bump actions/setup-node from 2.4.0 to 2.4.1 (#656) (52f1a50), closes #656

bump actions/setup-node from 2.4.1 to 2.5.0 (#673) (88eb3e4), closes #673

bump actions/setup-node from 2.5.0 to 2.5.1 (#689) (127e2d7), closes #689

bump actions/setup-node from 2.5.1 to 3 (#713) (c188bee), closes #713

bump actions/upload-artifact from 2 to 3 (#732) (fb2c292), closes #732

bump codecov/codecov-action from 1.5.0 to 1.5.2 (#622) (3087a34), closes #622

bump codecov/codecov-action from 1.5.2 to 2.0.1 (#631) (90e01d5), closes #631

bump codecov/codecov-action from 2.0.1 to 2.0.2 (#634) (d4b79ae), closes #634

bump codecov/codecov-action from 2.0.2 to 2.0.3 (#646) (e363e57), closes #646

bump codecov/codecov-action from 2.0.3 to 2.1.0 (#655) (40515c6), closes #655

bump codecov/codecov-action from 2.1.0 to 3 (#729) (1226087), closes #729

bump codecov/codecov-action from v1.3.1 to v1.3.2 (#594) (1d0fa1a), closes #594

bump codecov/codecov-action from v1.3.2 to v1.4.0 (#602) (b4ccfe8), closes #602

... (truncated)

Commits

de7ea6f chore(release): 3.9.0
1bf4b35 chore(release): Add build assets
44a2b44 feat: bump node12 to node16 (#791)
2bef62f ci: use actions-github-app-token
2c04d6b ci: bump peaceiris/workflows from 0.16.0 to 0.17.1 (#789)
f2ac8b6 chore: fix year
402af2b chore: add duplicate
e1448a7 docs: bump hugo-version to 0.101.0 (#779)
2eea5d7 ci: drop ubuntu-18.04, add 22.04, latest (#776)
765cf11 docs: add note GitHub official Action
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [peaceiris/actions-gh-pages](https://github.com/peaceiris/actions-gh-pages) from 3.8.0 to 3.9.0. - [Release notes](https://github.com/peaceiris/actions-gh-pages/releases) - [Changelog](https://github.com/peaceiris/actions-gh-pages/blob/main/CHANGELOG.md) - [Commits](peaceiris/actions-gh-pages@068dc23...de7ea6f) --- updated-dependencies: - dependency-name: peaceiris/actions-gh-pages dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

codecov · 2022-10-24T17:20:18Z

Codecov Report

Merging #73 (72bdba0) into main (323424f) will not change coverage.
The diff coverage is n/a.

@@            Coverage Diff            @@
##              main       #73   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            2         2           
  Lines           16        16           
=========================================
  Hits            16        16

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

gilesknap · 2022-11-01T09:00:24Z

This appears to have broken with permissions issue. Has the action changed the way it does the push to git?

garryod · 2022-11-07T11:16:33Z

This appears to have broken with permissions issue. Has the action changed the way it does the push to git?

Hi Giles,

The issue is not with the action itself but rather the permissions given to dependabot. Dependabot PRs are treated like PRs from forks and aren't given access to workflow secrets. See: https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions/

coretl · 2022-11-07T11:24:38Z

That's annoying, we need to exclude dependabot PRs in this statement then:
https://github.com/DiamondLightSource/python3-pip-skeleton/blob/main/.github/workflows/docs.yml#L54

coretl · 2022-11-07T11:26:01Z

Is there a ${{ github.is_dependabot }} or something similar?

coretl · 2022-11-07T11:31:07Z

https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#responding-to-events

github.actor == 'dependabot[bot]'

garryod · 2022-11-07T13:39:21Z

There are three options,

Elevate the permissions of the action with:
```
jobs:
 docs:
   permissions:
     contents: write
```
This opens up the possibility of a malicious change to one of the actions within ruining our repo, so I would recommend against this.
Skip if the the user is dependabot. This should work for now but will not solve the issue when it comes to forked PRs.
Skip if the user doesn't have write permission. (using an action like: https://github.com/marketplace/actions/check-user-permission). It's a bit more work, but the most "correct" solution

coretl · 2022-11-07T14:40:56Z

I vote for 2. The likelihood of dependabot updating something that subtly reformats the docs and someone spotting it are slim, so no point in pushing gh-pages anyway

gilesknap · 2022-11-08T07:16:37Z

With 2. if we have a legitimate user with incorrect permissions it will fail silently and cause confusion. I'm not sure how likely that is but I also find Tom's "if github.actor == 'dependabot[bot]'" more explicitly describes what we are doing.

EDIT: Ah OK forked PRs are still an issue so @garryod is right

gilesknap · 2022-11-09T14:35:13Z

I think I took too much acid before my previous post on this. Please ignore.

I've gone with 2. and bumped the actions-gh-pages manually in #79

dependabot · 2022-11-09T14:35:19Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 24, 2022

gilesknap closed this Nov 9, 2022

dependabot Bot deleted the dependabot/github_actions/peaceiris/actions-gh-pages-3.9.0 branch November 9, 2022 14:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump peaceiris/actions-gh-pages from 3.8.0 to 3.9.0#73

Bump peaceiris/actions-gh-pages from 3.8.0 to 3.9.0#73
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/peaceiris/actions-gh-pages-3.9.0

dependabot Bot commented on behalf of github Oct 24, 2022

Uh oh!

codecov Bot commented Oct 24, 2022 •

edited

Loading

Uh oh!

gilesknap commented Nov 1, 2022

Uh oh!

garryod commented Nov 7, 2022

Uh oh!

coretl commented Nov 7, 2022 •

edited

Loading

Uh oh!

coretl commented Nov 7, 2022

Uh oh!

coretl commented Nov 7, 2022

Uh oh!

garryod commented Nov 7, 2022

Uh oh!

coretl commented Nov 7, 2022

Uh oh!

gilesknap commented Nov 8, 2022 •

edited

Loading

Uh oh!

gilesknap commented Nov 9, 2022

Uh oh!

dependabot Bot commented on behalf of github Nov 9, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dependabot Bot commented on behalf of github Oct 24, 2022

actions-github-pages v3.9.0

Changelog

3.9.0 (2022-10-23)

chore

ci

Uh oh!

codecov Bot commented Oct 24, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

gilesknap commented Nov 1, 2022

Uh oh!

garryod commented Nov 7, 2022

Uh oh!

coretl commented Nov 7, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coretl commented Nov 7, 2022

Uh oh!

coretl commented Nov 7, 2022

Uh oh!

garryod commented Nov 7, 2022

Uh oh!

coretl commented Nov 7, 2022

Uh oh!

gilesknap commented Nov 8, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gilesknap commented Nov 9, 2022

Uh oh!

dependabot Bot commented on behalf of github Nov 9, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov Bot commented Oct 24, 2022 •

edited

Loading

coretl commented Nov 7, 2022 •

edited

Loading

gilesknap commented Nov 8, 2022 •

edited

Loading