You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I don't know if this is related to #4781 (comment). There are other workflows that haven't been hash-pinned.
Ironically, I'm trying to show the original harfbuzz repository that dependabot can help update hash-pinned GitHub Actions and so just changed one file as an example. I'll try to change all the other workflows too...
Confirmed. When I hash-pinned all other instances of an Action (to an outdated version), dependabot sent a PR to update it to a new version.
This behavior is still a problematic bug, though: should a project create a new workflow and accidentally tag-pin it instead of hash-pin it, the hashes will almost never be updated, especially if the Action is major-version pinned (i.e. actions/checkout@v3).
pnacht
changed the title
Hash-pinned GitHub Actions aren't getting updated
Hash-pinned GitHub Actions aren't updated if they're tag-pinned elsewhere
Jun 9, 2023
Is there an existing issue for this?
Package ecosystem
github-actions
Package manager version
No response
Language version
No response
Manifest location and content before the Dependabot update
All of the hash-pinned Actions in https://github.com/pnacht/harfbuzz/blob/main/.github/workflows/linux-ci.yml (MWE'd below) are out-of-date:
dependabot.yml content
https://github.com/pnacht/harfbuzz/blob/main/.github/dependabot.yml:
Updated dependency
None of the Actions were updated
What you expected to see, versus what you actually saw
I expected to receive PRs updating each of the Actions to their most up-to-date version, such that the end result would be:
Native package manager behavior
No response
Images of the diff or a link to the PR, issue, or logs
Logs:
Smallest manifest that reproduces the issue
I haven't tested this, but I assume this would demonstrate the issue:
The text was updated successfully, but these errors were encountered: