From 108ac57db46b337bff299e40dce8a6de93e2c331 Mon Sep 17 00:00:00 2001 From: forkwright Date: Mon, 24 Aug 2026 19:49:52 -0500 Subject: [PATCH] fix(ci): name the major the fetch-metadata pin actually is The pin comment read `# v2` while its sha resolves to v3.1.0. No version changes here -- the sha is untouched; only the comment moves, to say what the sha already was. This file matters beyond itself: it is the reusable workflow theatron and sphragis call, so a wrong version comment here is the one a reader checking "which fetch-metadata does the fleet auto-merger use" would find and believe. Cause: dependabot rewrites a pin comment only when it can parse a precise version out of the existing one. `# v2` gives it nothing to rewrite, so the bump across the major boundary moved the sha and left the comment behind. `# v3.1.0` rather than `# v3` because upstream publishes both tags against this sha, so the precise one exists and is what dependabot will maintain from here. Verified with utilities/check-action-pin-comments.py: 28 pins checked, 0 naming the wrong major after this change. The same comment is wrong in aletheia and harmonia and is being fixed there too. --- .github/workflows/dependabot-auto-merge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 2dca87a..a53d57c 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -20,7 +20,7 @@ jobs: steps: - name: Fetch Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v2 + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: ${{ secrets.GITHUB_TOKEN }}