Skip to content

Update non-major dependencies #38

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
renovate merged 1 commit into from
Aug 16, 2025
Merged

Update non-major dependencies #38

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions .github/workflows/build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
contents: write
steps:
- name: Checkout source branch
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
ref: ${{ env.SOURCE_BRANCH }}
path: source-folder
Comment on lines 22 to 26
Copy link

@github-actions github-actions bot Aug 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You have several repeated checkout steps pinned to a specific commit SHA (08eba0b27…). This pattern appears multiple times for both source and release branches. Consider refactoring this repetition by extracting a reusable workflow or using YAML anchors/aliases to DRY up the file and make future maintenance easier.

Also, instead of pinning to a full SHA, use a version tag like actions/checkout@v4. That way you get backward-compatible updates automatically and avoid manual bumps for every minor or patch release. For example:

uses: actions/checkout@v4
with:
  ref: ${{ env.SOURCE_BRANCH }}
  path: source-folder

Expand Down Expand Up @@ -66,7 +66,7 @@ jobs:
fi

- name: Checkout release branch
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
ref: ${{ env.RELEASE_BRANCH }}
path: release-folder
Expand Down Expand Up @@ -102,7 +102,7 @@ jobs:
pull-requests: write
steps:
- name: Checkout release branch
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
ref: ${{ env.RELEASE_BRANCH }}
- name: Run the AI-assisted action (PR Summary)
Comment on lines 102 to 108
Copy link

@github-actions github-actions bot Aug 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This checkout-release block is duplicated in multiple jobs. Apply the same DRY principle here by using a composite action or YAML anchor to reduce duplication. And again, pin to actions/checkout@v4 instead of a specific commit SHA.

Expand All @@ -123,7 +123,7 @@ jobs:
pull-requests: write
steps:
- name: Checkout release branch
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
ref: ${{ env.RELEASE_BRANCH }}
- name: Run the AI-assisted action (PR Review)
Expand All @@ -143,7 +143,7 @@ jobs:
contents: write
steps:
- name: Checkout release branch
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
ref: ${{ env.RELEASE_BRANCH }}
- name: Create tags for new version
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/code-quality.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
path: [pr-summary, pr-review]
steps:
- name: Checkout source branch
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
Comment on lines 22 to +23
Copy link

@github-actions github-actions bot Aug 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This checkout step is pinned to a SHA. To simplify your workflow and reduce maintenance, pin to the major version tag (e.g., actions/checkout@v4) so that minor/patch updates are automatically adopted without changing the SHA manually.

- name: Setup Node
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
Expand All @@ -45,7 +45,7 @@ jobs:
path: [pr-summary, pr-review]
steps:
- name: Checkout source branch
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
- name: Setup Node
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
Expand Down
140 changes: 70 additions & 70 deletions pr-review/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions pr-review/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,16 +31,16 @@
},
"devDependencies": {
"@eslint/js": "9.33.0",
"@types/node": "22.17.1",
"@types/node": "22.17.2",
"@vercel/ncc": "0.38.3",
Comment on lines -34 to 35
Copy link

@github-actions github-actions bot Aug 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The dependency @types/node is pinned to an exact version (22.17.2). To allow backward-compatible patch updates without manual bumps, use a semver range like:

"@types/node": "^22.17.2"

"eslint": "9.33.0",
"eslint-plugin-import": "2.32.0",
"eslint-plugin-sonarjs": "3.0.4",
"eslint-plugin-unicorn": "60.0.0",
"prettier": "3.6.2",
"tsx": "4.20.3",
"tsx": "4.20.4",
Copy link

@github-actions github-actions bot Aug 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The tsx devDependency is pinned exactly (4.20.4). Apply a semver range ("^4.20.4") to automatically receive patch fixes and minimize manual version updates.

"typescript": "5.9.2",
"typescript-eslint": "8.39.0",
"typescript-eslint": "8.39.1",
Copy link

@github-actions github-actions bot Aug 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similarly, for typescript-eslint, use a semver range such as:

"typescript-eslint": "^8.39.1"

This ensures future patch-level fixes are pulled in automatically.

"yaml": "2.8.1"
}
}
Loading