GitHub Actions version pinning dropped

[na-jakobs]

Is there an existing issue for this?

• I have searched the existing issues

Package ecosystem

github-actions

Package manager version

No response

Language version

No response

Manifest location and content before the Dependabot update

No response

dependabot.yml content

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "daily"

Updated dependency

No response

What you expected to see, versus what you actually saw

Expected to see an update to the latest sha along with an update to the comment.

Removed:

steps:
   - name: Checkout repo
     uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2

Added:

steps:
   - name: Checkout repo
     uses: actions/checkout@v4 # v3.5.2

Native package manager behavior

No response

Images of the diff or a link to the PR, issue, or logs

Smallest manifest that reproduces the issue

No response

[RazerM]

I have the same issue in https://github.com/getlogbook/logbook/pull/356/files

[yeikel]

I have the same issue in https://github.com/getlogbook/logbook/pull/356/files

Your issue seems to be a valid duplicate of this #7966

In particular, the reason seems to be this : #7966 (comment)

@na-jakobs Can you share a link to your pull request/manifest? If sharing the pull request is not possible because it is a private repository, please share the patch instead

I am trying to see if the symptoms are the same as the pull request shared above. If so, we can probably close this as duplicate and upvote the other

[RazerM]

@yeikel I'm referring to this file, which dependabot is bumping a commit hash to a tag: https://github.com/getlogbook/logbook/pull/356/files#diff-ab7cd36ad831c30099773459b80595fd3b72612f333f6a2f4e11c2606176999f

[yeikel]

@yeikel I'm referring to this file, which dependabot is bumping a commit hash to a tag: https://github.com/getlogbook/logbook/pull/356/files#diff-ab7cd36ad831c30099773459b80595fd3b72612f333f6a2f4e11c2606176999f

Yep, your issue seems to be the same as #7966 where due to you having a mix of formats, dependabot incorrectly uses one of the formats as opposed to respecting them

See this comment for an explanation #7966 (comment)

[deivid-rodriguez]

This will get fixed by #8068!