chore(deps): bump devantler-tech/actions/.github/workflows/template-sync.yaml from 13.2.3 to 13.3.0 - #222
Conversation
…ync.yaml Bumps [devantler-tech/actions/.github/workflows/template-sync.yaml](https://github.com/devantler-tech/actions) from 13.2.3 to 13.3.0. - [Release notes](https://github.com/devantler-tech/actions/releases) - [Changelog](https://github.com/devantler-tech/actions/blob/main/CHANGELOG.md) - [Commits](devantler-tech/actions@3ee6cb9...4f4e07a) --- updated-dependencies: - dependency-name: devantler-tech/actions/.github/workflows/template-sync.yaml dependency-version: 13.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
![botantler-1[bot]](https://avatars.githubusercontent.com/in/1025824?s=60&v=4){kind=small}
…228) The pin contract requires every devantler-tech/actions caller to pin the same commit and carry the same version comment. Dependabot opens one PR per caller, so each of #219, #221 and #222 bumps a single file and leaves the other two at v13.2.3 -- failing "every devantler-tech/actions caller must pin the same commit" on all three. None of them can merge alone, and auto-merge cannot resolve it, so the three deadlock each other. Bump all three callers together so the invariant holds: cd.yaml publish-app.yaml release.yaml create-release.yaml template-sync.yaml template-sync.yaml to 4f4e07a3ebf3e1161756a292966e36c91a65ee04 (v13.3.0). Verified: the tag v13.3.0 resolves to that commit, all three reusable workflows exist there, and the commit is identical to the actions default branch. Reproduced the failure by bumping one file (RED) and confirmed the atomic bump passes (GREEN). Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Superseded by #228, which merged as This PR could not merge on its own. The pin contract requires every caller to ride the same commit, The dependency this PR proposes is already on Recurrence is tracked in #227 and fixed by #229, which groups these bumps into a single PR. |
Pull request was closed
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
…229) The workflow-caller pin contract requires all three devantler-tech/actions callers to ride one commit. Dependabot treats each reusable workflow as its own dependency, so ungrouped it opens one PR per caller -- #219, #221 and #222 each touched exactly one file -- and each lands with the other two behind, failing "every devantler-tech/actions caller must pin the same commit" in required CI. No merge order rescues it, so the PRs deadlock and the update never lands. devantler-tech/platform-tenant-template already carries this fix, but .github/dependabot.yml is listed in .templatesyncignore -- this tenant owns the file so it can add the npm and docker ecosystems -- so template-sync has never delivered it here. Add the grouping to the github-actions ecosystem only. npm, docker, the open-pull-requests-limit and the devantler-tech/* cooldown exclusion are unchanged; the change is a pure insertion, with all 28 original lines intact. Fixes #227 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
1 participant
Bumps devantler-tech/actions/.github/workflows/template-sync.yaml from 13.2.3 to 13.3.0.
Release notes
Sourced from devantler-tech/actions/.github/workflows/template-sync.yaml's releases.
Changelog
Sourced from devantler-tech/actions/.github/workflows/template-sync.yaml's changelog.
... (truncated)
Commits
4f4e07achore(main): release 13.3.0 (#1139)86bf055feat(security): turn signed auto-fix commits on, including for the org-requir...590e8d9test(security): match the apply-fixes signing call by shape, not by spacing (...5d37648test(security): assert the org-required Go pipeline's fixer lanes hold no wri...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)