Skip to content

chore(deps): bump devops-infra/action-pull-request from 0.6.1 to 1.0.2 #622

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump devops-infra/action-pull-request from 0.6.1 to 1.0.2 #622

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 20, 2025

Bumps devops-infra/action-pull-request from 0.6.1 to 1.0.2.

Release notes

Sourced from devops-infra/action-pull-request's releases.

v1.0.2

What's Changed

Full Changelog: devops-infra/action-pull-request@v1.0.1...v1.0.2

v1.0.1

What's Changed

Full Changelog: devops-infra/action-pull-request@v1.0.0...v1.0.1

v1.0.0

What's Changed

Full Changelog: devops-infra/action-pull-request@v0.6...v1.0.0

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump devops-infra/action-pull-request from 0.6.1 to 1.0.2
ee5e54f 
Bumps [devops-infra/action-pull-request](https://github.com/devops-infra/action-pull-request) from 0.6.1 to 1.0.2.
- [Release notes](https://github.com/devops-infra/action-pull-request/releases)
- [Commits](devops-infra/action-pull-request@v0.6.1...v1.0.2)

---
updated-dependencies:
- dependency-name: devops-infra/action-pull-request
  dependency-version: 1.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 20, 2025
@dependabot dependabot bot requested a review from lazyxeon as a code owner October 20, 2025 15:00
@dependabot dependabot bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Oct 20, 2025
@coderabbitai
Copy link

coderabbitai bot commented Oct 20, 2025

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Comment @coderabbitai help to get the list of available commands and usage tips.

@chatgpt-codex-connector
Copy link

chatgpt-codex-connector bot commented Oct 20, 2025

💡 Codex Review

Genesis-Code-Protocol/.github/dependency-review-config.yml

Lines 7 to 23 in ee5e54f

# List of licenses that are explicitly denied
# List of licenses that are explicitly allowed
allow-licenses:
- MIT
- Apache-2.0
- BSD-2-Clause
- BSD-3-Clause
- ISC
- Unlicense
- CC0-1.0
- GPL-2.0
- GPL-3.0
- AGPL-3.0
- LGPL-2.1
- LGPL-3.0

P1 Badge GPL licenses moved from deny to allow list

The dependency-review configuration used to fail the check when GPL or AGPL licenses were detected (deny_licenses included GPL, AGPL, LGPL), but the new file removes the deny list entirely and adds those licenses to allow-licenses. Because the action treats the allow list as a whitelist, this change now explicitly permits GPL/AGPL/LGPL dependencies instead of blocking them, which weakens the repository’s license-compliance gate and may allow copyleft dependencies to slip in unnoticed.

Genesis-Code-Protocol/.github/workflows/pre-commit.yml

Lines 98 to 103 in ee5e54f

CURRENT_BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
echo "Detected branch: $CURRENT_BRANCH"
# Ensure we are on the branch (checkout already did, but be explicit)
git checkout "$CURRENT_BRANCH"

P1 Badge Pre-commit workflow fails on PRs due to missing branch fetch

The new auto-fix step unconditionally runs git checkout "$CURRENT_BRANCH" before checking whether any files changed. On pull request events the checkout action pulls only the merge ref (refs/pull/*/merge) and does not create a local branch named after GITHUB_HEAD_REF; as a result this git checkout fails with pathspec … did not match, aborting the whole job even when there are no fixes to apply. Fetch or create the head branch before switching to it, or skip the explicit checkout entirely to avoid breaking all same-repo PR runs.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

@github-actions
Copy link
Contributor

github-actions bot commented Oct 20, 2025

Dependency Review

The following issues were found:

  • ✅ 0 vulnerable package(s)
  • ❌ 32 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 6 package(s) with unknown licenses.

View full job summary

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lazyxeon lazyxeon Awaiting requested review from lazyxeon lazyxeon is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant