Take the five action bumps as one change, and group future ones - #46
Merged
Conversation
Dependabot opened a separate PR for each of checkout, setup-python, setup-uv, upload-artifact and download-artifact. Same five bumps here, plus a `groups` key so that next month's arrive as one PR rather than five. The majors are all node 24 runtime upgrades, which only constrain self-hosted runners; these workflows are on ubuntu-latest. upload-artifact v7 and download-artifact v8 are the intended pair: v8 skips unzipping non-zipped downloads to support v7's optional direct uploads, and defaults hash mismatches to an error. Neither affects the default path this repo uses. Note that CI does not exercise the artifact pair. They live in the publish workflow, which only runs on a release.
This was referenced Aug 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot opened #41 through #45, one per action. This is the same five bumps
as a single change, plus the config key that stops it happening again.
Supersedes #41, #42, #43, #44 and #45, which need closing by hand — closing
keywords only act on issues, not on other pull requests.
The bumps
Every major here is a node 24 runtime upgrade. The "breaking" label on them is
about minimum runner version, which constrains self-hosted runners; both
workflows are on
ubuntu-latest.The pair worth checking rather than waving through is upload/download, because
dependabot bumped them to different majors and they have to agree. They do:
download v8's release notes say it skips unzipping non-zipped downloads
specifically "to support direct uploads in
actions/upload-artifact", which isupload v7's new
archive: false. v7 and v8 are the intended pair. Neitherchange touches the default path — this repo uploads a
dist/directory, whichis still zipped, and does not set
archiveorskip-decompress. v8 alsopromotes a download hash mismatch from a warning to an error, which is a
behaviour change we want.
The last three rows are not covered by CI, because they only appear in
python-publish.yml, which runs onrelease: published. A green run on this PRsays nothing about them; the first real exercise is publishing 2.2.0. That is
worth knowing before the release rather than during it.
The grouping
Ungrouped, a month of action releases is five PRs that each want a review and a
CI run, for what is one decision. Grouped, it is one.
Also corrects the comment in that file, which claimed the actions are pinned to
commit SHAs. Only
pypa/gh-action-pypi-publishis; the rest track major tags,which is the usual line for first-party
actions/*.astral-sh/setup-uvisthird party and arguably belongs on a SHA, but that is a separate hardening
decision rather than something to fold into a version bump.