fix(ci): name the major the fetch-metadata pin actually is - #51
Merged
Conversation
The pin comment read `# v2` while its sha resolves to v3.1.0. No version changes here -- the sha is untouched; only the comment moves, to say what the sha already was. This file matters beyond itself: it is the reusable workflow theatron and sphragis call, so a wrong version comment here is the one a reader checking "which fetch-metadata does the fleet auto-merger use" would find and believe. Cause: dependabot rewrites a pin comment only when it can parse a precise version out of the existing one. `# v2` gives it nothing to rewrite, so the bump across the major boundary moved the sha and left the comment behind. `# v3.1.0` rather than `# v3` because upstream publishes both tags against this sha, so the precise one exists and is what dependabot will maintain from here. Verified with utilities/check-action-pin-comments.py: 28 pins checked, 0 naming the wrong major after this change. The same comment is wrong in aletheia and harmonia and is being fixed there too.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The pin comment read
# v2while its sha resolves to v3.1.0. No versionchanges here -- the sha is untouched; only the comment moves, to say what the
sha already was.
This file matters beyond itself: it is the reusable workflow theatron and
sphragis call, so a wrong version comment here is the one a reader checking
"which fetch-metadata does the fleet auto-merger use" would find and believe.
Cause: dependabot rewrites a pin comment only when it can parse a precise
version out of the existing one.
# v2gives it nothing to rewrite, so thebump across the major boundary moved the sha and left the comment behind.
# v3.1.0rather than# v3because upstream publishes both tags against thissha, so the precise one exists and is what dependabot will maintain from here.
Verified with utilities/check-action-pin-comments.py: 28 pins checked, 0 naming
the wrong major after this change. The same comment is wrong in aletheia and
harmonia and is being fixed there too.