-
Notifications
You must be signed in to change notification settings - Fork 42
build(deps): bump peter-evans/create-pull-request from 6.0.5 to 7.0.9 #224
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
build(deps): bump peter-evans/create-pull-request from 6.0.5 to 7.0.9 #224
Conversation
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 6.0.5 to 7.0.9. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](peter-evans/create-pull-request@6d6857d...84ae59a) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-version: 7.0.9 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the Comment |
|
I believe this is needed for anyone to upgrade their workflow to use checkout@v6 |
…ility Root cause: DeterminateSystems/update-flake-lock@v27 uses peter-evans/create-pull-request@v6.0.5 internally, which is incompatible with actions/checkout@v6's new credential storage mechanism. The Problem Chain: - actions/checkout@v6 moved credentials from .git/config to $RUNNER_TEMP (security improvement) - peter-evans/create-pull-request@v6.0.5 cannot access credentials from the new $RUNNER_TEMP location - This causes exit code 128 when update-flake-lock tries to create PRs The Fix: - create-pull-request@v7.0.9 fixed v6 compatibility - However, update-flake-lock@v27 (released July 2025) hasn't upgraded yet - Reverting to v5 restores working credential access Testing: - Attempted quarto-dev git worktree credential propagation workaround - Testing confirmed it didn't resolve the issue - Root cause is in create-pull-request, not in our workflow Next Steps: - Can upgrade to v6 once update-flake-lock uses create-pull-request@v7.0.9+ - DeterminateSystems/update-flake-lock#224 - Dependabot configured to ignore v6 upgrades until compatibility is fixed Also adds release-25.11 to dependabot.yml for automated action updates on the current stable branch. Fixes: https://github.com/nix-community/home-manager/actions/runs/19712979574 See: peter-evans/create-pull-request#690 Signed-off-by: Austin Horstman <khaneliman12@gmail.com>
…ility Root cause: DeterminateSystems/update-flake-lock@v27 uses peter-evans/create-pull-request@v6.0.5 internally, which is incompatible with actions/checkout@v6's new credential storage mechanism. The Problem Chain: - actions/checkout@v6 moved credentials from .git/config to $RUNNER_TEMP (security improvement) - peter-evans/create-pull-request@v6.0.5 cannot access credentials from the new $RUNNER_TEMP location - This causes exit code 128 when update-flake-lock tries to create PRs The Fix: - create-pull-request@v7.0.9 fixed v6 compatibility - However, update-flake-lock@v27 (released July 2025) hasn't upgraded yet - Reverting to v5 restores working credential access Next Steps: - Can upgrade to v6 once update-flake-lock uses create-pull-request@v7.0.9+ - DeterminateSystems/update-flake-lock#224 - Dependabot configured to ignore v6 upgrades until compatibility is fixed Fixes: https://github.com/nix-community/home-manager/actions/runs/19712979574 See: peter-evans/create-pull-request#690 Signed-off-by: Austin Horstman <khaneliman12@gmail.com>
…ility Root cause: DeterminateSystems/update-flake-lock@v27 uses peter-evans/create-pull-request@v6.0.5 internally, which is incompatible with actions/checkout@v6's new credential storage mechanism. The Problem Chain: - actions/checkout@v6 moved credentials from .git/config to $RUNNER_TEMP (security improvement) - peter-evans/create-pull-request@v6.0.5 cannot access credentials from the new $RUNNER_TEMP location - This causes exit code 128 when update-flake-lock tries to create PRs The Fix: - create-pull-request@v7.0.9 fixed v6 compatibility - However, update-flake-lock@v27 (released July 2025) hasn't upgraded yet - Reverting to v5 restores working credential access Next Steps: - Can upgrade to v6 once update-flake-lock uses create-pull-request@v7.0.9+ - DeterminateSystems/update-flake-lock#224 - Dependabot configured to ignore v6 upgrades until compatibility is fixed Fixes: https://github.com/nix-community/home-manager/actions/runs/19712979574 See: peter-evans/create-pull-request#690 Signed-off-by: Austin Horstman <khaneliman12@gmail.com>
@khaneliman Any chance you could check if that is true (i.e. point at this PR and see if it works) and report back? I'd be happy to merge and cut a new release if that's the case. |
Testing if DeterminateSystems/update-flake-lock#224 fixes the actions/checkout@v6 incompatibility by using the PR commit directly. If successful, this PR can be merged upstream to fix the issue. Signed-off-by: Austin Horstman <khaneliman12@gmail.com>
|
@cole-h pushed a commit and ran in my fork and seems to have worked |
|
Thanks for checking! |
…ility Root cause: DeterminateSystems/update-flake-lock@v27 uses peter-evans/create-pull-request@v6.0.5 internally, which is incompatible with actions/checkout@v6's new credential storage mechanism. The Problem Chain: - actions/checkout@v6 moved credentials from .git/config to $RUNNER_TEMP (security improvement) - peter-evans/create-pull-request@v6.0.5 cannot access credentials from the new $RUNNER_TEMP location - This causes exit code 128 when update-flake-lock tries to create PRs The Fix: - create-pull-request@v7.0.9 fixed v6 compatibility - However, update-flake-lock@v27 (released July 2025) hasn't upgraded yet - Reverting to v5 restores working credential access Next Steps: - Can upgrade to v6 once update-flake-lock uses create-pull-request@v7.0.9+ - DeterminateSystems/update-flake-lock#224 - Dependabot configured to ignore v6 upgrades until compatibility is fixed Fixes: https://github.com/nix-community/home-manager/actions/runs/19712979574 See: peter-evans/create-pull-request#690 Signed-off-by: Austin Horstman <khaneliman12@gmail.com>
Bumps peter-evans/create-pull-request from 6.0.5 to 7.0.9.
Release notes
Sourced from peter-evans/create-pull-request's releases.
... (truncated)
Commits
84ae59afix: compatibility with actions/checkout@v6 (#4230)b4733b9build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#4222)0edc001build(deps-dev): bump the npm group with 2 updates (#4201)430aea0build(deps): bump the github-actions group with 3 updates (#4200)46cdba7build(deps-dev): bump the npm group with 3 updates (#4185)b937339build(deps): bump the github-actions group with 2 updates (#4184)e9af275ci: update dependabot configd3e081abuild(deps-dev): bump@types/nodefrom 18.19.127 to 18.19.128 (#4178)9ec683ebuild(deps-dev): bump@types/nodefrom 18.19.125 to 18.19.127 (#4165)65d8d10build(deps-dev): bump ts-jest from 29.4.2 to 29.4.4 (#4163)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Fixes #223