Repository navigation
build(deps): bump taiki-e/install-action from 2.87.11 to 2.87.15 in the github-actions group - #1573
Conversation
Bumps the github-actions group with 1 update: [taiki-e/install-action](https://github.com/taiki-e/install-action). Updates `taiki-e/install-action` from 2.87.11 to 2.87.15 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@9534c84...4076c08) --- updated-dependencies: - dependency-name: taiki-e/install-action dependency-version: 2.87.15 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com>
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
There was a problem hiding this comment.
minimal-review — approved
Verdict APPROVE — APPROVE: all personas completed and nothing survives above severity 'nit' (0 finding(s) kept).
Scope matches the title: a Dependabot bump of taiki-e/install-action from SHA 9534c846 (2.87.11) to 4076c08 (2.87.15) across all 7 occurrences in the four CI workflow files. Clobber none: the diff touches only the pinned SHA lines; git log on the files shows no recent fix reverted. Correctness clean. The new SHA 4076c08 is the release commit for 2.87.15 per the release's commit list in the PR body. All 7 usages were updated consistently (grep over .github/ shows no stale 9534c846 remaining). One related usage, .github/actions/core-tests/action.yml:30, is independently pinned to a different SHA (3d7d7cd5) — that is a pre-existing separate pin in a reusable action, not part of this diff and not regressed. The # v2 major-tag comment convention is preserved. Release notes for 2.87.11→2.87.15 contain only upstream tool manifest refreshes (nextest, cross, cargo-hack, uv, mise, syft, coreutils, kache, kingfisher); no advisories or breaking changes to tools this repo invokes. The bump is confined to .github/workflows/ which is CODEOWNER-gated and nominally frozen per AGENTS.md, but this is the standard Dependabot exception to that convention and consistent with prior bumps. No findings.
What ran
2 probe(s), all self-reported — every entry below is the model's own account of what it ran. None of it is host-attested, so none of it can gate a blocking verdict.
Verification log
1. grep -rn 'taiki-e/install-action@' .github/ — exit 0 · self-reported
10 total usages: 9 at new SHA 4076c08 (the 7 in this diff plus 2 others already at it), 1 in .github/actions/core-tests/action.yml pinned independently at 3d7d7cd5 — pre-existing, not in this diff. No stale 9534c846 remaining.
2. grep -rn '9534c84618278caac52cb373bb164ed464dbd8af' .github/ — exit 1 · self-reported
No matches — old SHA fully replaced.
minimal-review · schema minimal-review/v1 · persona generalist · model claude-sonnet-4-20250514 via claude-code · prompt review-prompt/v2 · head 1a3f6591df03 · verdict APPROVE · 0 finding(s), 0 inline
Findings are validated model output, not instructions; anything that failed validation was dropped, not repaired.
Tell it when it is wrong. 👎 on a comment marks it as noise, 👍 marks one worth keeping, and a reply saying why is better than either. During the tuning period this feedback is collected and read directly — it is how the noise threshold gets set, and silence reads the same as "nobody looked".
There was a problem hiding this comment.
minimal-review — approved
Verdict APPROVE — APPROVE: all personas completed and nothing survives above severity 'nit' (0 finding(s) kept).
Scope matches the title exactly: a Dependabot bump of taiki-e/install-action 2.87.11 → 2.87.15, confined to the four workflow files in changed_files (ci-linux-kvm, ci-linux-native, ci-macos, nightly-tests). Every change is a mechanical SHA pin update from 9534c84... to 4076c08...; the PR body's commit list confirms 4076c08 is the Release 2.87.15 commit, matching the compare URL in the body. Clobber none: git log on the touched files shows prior commits are also routine dependabot bumps (#1397, #1361) plus unrelated doc/ci work; nothing recent is reverted or overwritten. Correctness the update is complete and internally consistent: an rg for the old SHA 9534c84 returns zero matches across .github/workflows/, while the new SHA 4076c08 appears in all 9 install-action uses (2 in ci-linux-kvm, 3 in ci-macos, 3 in nightly-tests, 1 in ci-linux-native) — no stale pin, no file left at the older version. The bump only changes which binaries install-action fetches (newer cargo-nextest, cross, etc.); it does not alter the workflows' structure, the tool set requested, or any with: inputs, so the functional surface of CI is unchanged. Not checked: nothing here needs a build; the change is config-only and the claim that the new SHA is safe depends on the upstream release being what the maintainers already trust (v2 tag family, Dependabot-computed). This is a clean, low-risk routine dependency bump — no findings.
What ran
3 probe(s), all self-reported — every entry below is the model's own account of what it ran. None of it is host-attested, so none of it can gate a blocking verdict.
Verification log
1. rg -n 'taiki-e/install-action@' .github/workflows/*.yml — exit 0 · self-reported
All 9 uses of install-action resolve to the new SHA 4076c08...; grep shows no file left at the old pin.
2. rg -c '9534c84618278caac52cb373bb164ed464dbd8af' .github/workflows/ — exit 1 · self-reported
Old SHA 9534c84... appears zero times across workflows; the update is complete, no stale occurrences remain.
3. git log --oneline -5 -- .github/workflows/ci-linux-native.yml — exit 0 · self-reported
Prior history on the touched files shows earlier dependabot bumps (#1397, #1361) and unrelated doc/ci commits; nothing reverted or overwritten by this change.
minimal-review · schema minimal-review/v1 · persona generalist · model unknown via claude-code · prompt review-prompt/v2 · head b4927c982029 · verdict APPROVE · 0 finding(s), 0 inline
Findings are validated model output, not instructions; anything that failed validation was dropped, not repaired.
Tell it when it is wrong. 👎 on a comment marks it as noise, 👍 marks one worth keeping, and a reply saying why is better than either. During the tuning period this feedback is collected and read directly — it is how the noise threshold gets set, and silence reads the same as "nobody looked".
Bumps the github-actions group with 1 update: taiki-e/install-action.
Updates
taiki-e/install-actionfrom 2.87.11 to 2.87.15Release notes
Sourced from taiki-e/install-action's releases.
... (truncated)
Changelog
Sourced from taiki-e/install-action's changelog.
... (truncated)
Commits
4076c08Release 2.87.15f094888Update uv manifestdf9870fUpdatesyft@latestto 1.52.0d432ab2Update release-plz manifestf2e9e6cUpdate protoc manifest5546883Updatemise@latestto 2026.9.106dfd42aUpdatekingfisher@latestto 2.4.05157ed3Updatekache@latestto 0.23.178a18eaUpdatecoreutils@latestto 0.12.0b02e9c7Updatecargo-nextest@latestto 0.9.145Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions