Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 24, 2025

Bumps peter-evans/create-pull-request from 6.0.5 to 7.0.9.

Release notes

Sourced from peter-evans/create-pull-request's releases.

Create Pull Request v7.0.9

⚙️ Fixes an incompatibility with the recently released actions/checkout@v6.

What's Changed

New Contributors

Full Changelog: peter-evans/create-pull-request@v7.0.8...v7.0.9

Create Pull Request v7.0.8

What's Changed

Full Changelog: peter-evans/create-pull-request@v7.0.7...v7.0.8

Create Pull Request v7.0.7

⚙️ Fixes an issue with commit signing where modifications to the same file in multiple commits squash into the first commit.

What's Changed

... (truncated)

Commits
  • 84ae59a fix: compatibility with actions/checkout@v6 (#4230)
  • b4733b9 build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#4222)
  • 0edc001 build(deps-dev): bump the npm group with 2 updates (#4201)
  • 430aea0 build(deps): bump the github-actions group with 3 updates (#4200)
  • 46cdba7 build(deps-dev): bump the npm group with 3 updates (#4185)
  • b937339 build(deps): bump the github-actions group with 2 updates (#4184)
  • e9af275 ci: update dependabot config
  • d3e081a build(deps-dev): bump @​types/node from 18.19.127 to 18.19.128 (#4178)
  • 9ec683e build(deps-dev): bump @​types/node from 18.19.125 to 18.19.127 (#4165)
  • 65d8d10 build(deps-dev): bump ts-jest from 29.4.2 to 29.4.4 (#4163)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Fixes #223

Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 6.0.5 to 7.0.9.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases)
- [Commits](peter-evans/create-pull-request@6d6857d...84ae59a)

---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 24, 2025
@coderabbitai
Copy link

coderabbitai bot commented Nov 24, 2025

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.


Comment @coderabbitai help to get the list of available commands and usage tips.

@khaneliman
Copy link

I believe this is needed for anyone to upgrade their workflow to use checkout@v6

khaneliman added a commit to khaneliman/home-manager that referenced this pull request Nov 26, 2025
…ility

Root cause: DeterminateSystems/update-flake-lock@v27 uses
peter-evans/create-pull-request@v6.0.5 internally, which is incompatible
with actions/checkout@v6's new credential storage mechanism.

The Problem Chain:
- actions/checkout@v6 moved credentials from .git/config to $RUNNER_TEMP
  (security improvement)
- peter-evans/create-pull-request@v6.0.5 cannot access credentials from
  the new $RUNNER_TEMP location
- This causes exit code 128 when update-flake-lock tries to create PRs

The Fix:
- create-pull-request@v7.0.9 fixed v6 compatibility
- However, update-flake-lock@v27 (released July 2025) hasn't upgraded yet
- Reverting to v5 restores working credential access

Testing:
- Attempted quarto-dev git worktree credential propagation workaround
- Testing confirmed it didn't resolve the issue
- Root cause is in create-pull-request, not in our workflow

Next Steps:
- Can upgrade to v6 once update-flake-lock uses create-pull-request@v7.0.9+
  - DeterminateSystems/update-flake-lock#224
- Dependabot configured to ignore v6 upgrades until compatibility is fixed

Also adds release-25.11 to dependabot.yml for automated action updates
on the current stable branch.

Fixes: https://github.com/nix-community/home-manager/actions/runs/19712979574
See: peter-evans/create-pull-request#690

Signed-off-by: Austin Horstman <khaneliman12@gmail.com>
khaneliman added a commit to khaneliman/home-manager that referenced this pull request Nov 26, 2025
…ility

Root cause: DeterminateSystems/update-flake-lock@v27 uses
peter-evans/create-pull-request@v6.0.5 internally, which is incompatible
with actions/checkout@v6's new credential storage mechanism.

The Problem Chain:
- actions/checkout@v6 moved credentials from .git/config to $RUNNER_TEMP
  (security improvement)
- peter-evans/create-pull-request@v6.0.5 cannot access credentials from
  the new $RUNNER_TEMP location
- This causes exit code 128 when update-flake-lock tries to create PRs

The Fix:
- create-pull-request@v7.0.9 fixed v6 compatibility
- However, update-flake-lock@v27 (released July 2025) hasn't upgraded yet
- Reverting to v5 restores working credential access

Next Steps:
- Can upgrade to v6 once update-flake-lock uses create-pull-request@v7.0.9+
  - DeterminateSystems/update-flake-lock#224
- Dependabot configured to ignore v6 upgrades until compatibility is fixed

Fixes: https://github.com/nix-community/home-manager/actions/runs/19712979574
See: peter-evans/create-pull-request#690

Signed-off-by: Austin Horstman <khaneliman12@gmail.com>
khaneliman added a commit to nix-community/home-manager that referenced this pull request Nov 26, 2025
…ility

Root cause: DeterminateSystems/update-flake-lock@v27 uses
peter-evans/create-pull-request@v6.0.5 internally, which is incompatible
with actions/checkout@v6's new credential storage mechanism.

The Problem Chain:
- actions/checkout@v6 moved credentials from .git/config to $RUNNER_TEMP
  (security improvement)
- peter-evans/create-pull-request@v6.0.5 cannot access credentials from
  the new $RUNNER_TEMP location
- This causes exit code 128 when update-flake-lock tries to create PRs

The Fix:
- create-pull-request@v7.0.9 fixed v6 compatibility
- However, update-flake-lock@v27 (released July 2025) hasn't upgraded yet
- Reverting to v5 restores working credential access

Next Steps:
- Can upgrade to v6 once update-flake-lock uses create-pull-request@v7.0.9+
  - DeterminateSystems/update-flake-lock#224
- Dependabot configured to ignore v6 upgrades until compatibility is fixed

Fixes: https://github.com/nix-community/home-manager/actions/runs/19712979574
See: peter-evans/create-pull-request#690

Signed-off-by: Austin Horstman <khaneliman12@gmail.com>
@cole-h
Copy link
Member

cole-h commented Nov 26, 2025

I believe this is needed for anyone to upgrade their workflow to use checkout@v6

@khaneliman Any chance you could check if that is true (i.e. point at this PR and see if it works) and report back? I'd be happy to merge and cut a new release if that's the case.

khaneliman added a commit to khaneliman/home-manager that referenced this pull request Nov 26, 2025
Testing if DeterminateSystems/update-flake-lock#224 fixes the
actions/checkout@v6 incompatibility by using the PR commit directly.

If successful, this PR can be merged upstream to fix the issue.

Signed-off-by: Austin Horstman <khaneliman12@gmail.com>
@khaneliman
Copy link

@cole-h pushed a commit and ran in my fork and seems to have worked
https://github.com/khaneliman/home-manager/actions/runs/19717390995/job/56492700233

@cole-h cole-h merged commit 834c491 into main Nov 26, 2025
3 checks passed
@cole-h cole-h deleted the dependabot/github_actions/peter-evans/create-pull-request-7.0.9 branch November 26, 2025 21:17
@cole-h
Copy link
Member

cole-h commented Nov 26, 2025

Thanks for checking!

onemoresuza pushed a commit to onemoresuza/home-manager that referenced this pull request Nov 27, 2025
…ility

Root cause: DeterminateSystems/update-flake-lock@v27 uses
peter-evans/create-pull-request@v6.0.5 internally, which is incompatible
with actions/checkout@v6's new credential storage mechanism.

The Problem Chain:
- actions/checkout@v6 moved credentials from .git/config to $RUNNER_TEMP
  (security improvement)
- peter-evans/create-pull-request@v6.0.5 cannot access credentials from
  the new $RUNNER_TEMP location
- This causes exit code 128 when update-flake-lock tries to create PRs

The Fix:
- create-pull-request@v7.0.9 fixed v6 compatibility
- However, update-flake-lock@v27 (released July 2025) hasn't upgraded yet
- Reverting to v5 restores working credential access

Next Steps:
- Can upgrade to v6 once update-flake-lock uses create-pull-request@v7.0.9+
  - DeterminateSystems/update-flake-lock#224
- Dependabot configured to ignore v6 upgrades until compatibility is fixed

Fixes: https://github.com/nix-community/home-manager/actions/runs/19712979574
See: peter-evans/create-pull-request#690

Signed-off-by: Austin Horstman <khaneliman12@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

PR creation broken

3 participants