From 895f45dd1d96a53420f02c9191695e950ffcee24 Mon Sep 17 00:00:00 2001 From: Manvendra Date: Thu, 9 Jul 2026 00:30:35 +0530 Subject: [PATCH] ci: align release.yml action versions with sync-check Dependabot's github-actions group bumped sync-check.yml to actions/checkout@v7 and actions/setup-node@v6 (PR #15). release.yml was added after that config landed but before the bump reached it, so the two workflows pinned different major versions of the same two actions: sync-check.yml checkout@v7 setup-node@v6 release.yml checkout@v5 setup-node@v5 Nothing was broken -- v5 still runs -- but a repo that ships a supply-chain-security skill should not have two workflows disagreeing about which major version of an action they trust, and Dependabot's grouped weekly PR would have raised them separately and confusingly. Note release.yml only runs on a `v*` tag push, so this PR's CI does not exercise it. The evidence that v7/v6 work is sync-check.yml, which has been green on them since PR #15. --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 90d78ea..eab63d5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,9 +19,9 @@ jobs: name: Cut GitHub Release runs-on: ubuntu-latest steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@v7 - - uses: actions/setup-node@v5 + - uses: actions/setup-node@v6 with: node-version: '24'