Skip to content
This repository has been archived by the owner on Sep 28, 2024. It is now read-only.

chore(deps): bump actions/setup-node from 3.4.1 to 3.5.0 #19

Merged
merged 1 commit into from
Sep 28, 2022
Merged

chore(deps): bump actions/setup-node from 3.4.1 to 3.5.0 #19

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ jobs:
- name: Install Pulumi CLI
uses: pulumi/action-install-pulumi-cli@b374ceb6168550de27c6eba92e01c1a774040e11 # tag=v2.0.0
- name: Setup Node
uses: actions/setup-node@2fddd8803e2f5c9604345a0b591c3020ee971a93 # tag=v3.4.1
uses: actions/setup-node@969bd2663942d722d85b6a8626225850c2f7be4b # tag=v3.4.1
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dirien I would have expected that Dependabot would update the tag name in the comment to remain in sync. Wrong expectations on my side?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I mixed it up with the renovate bot!

There is a Issue dependabot/dependabot-core#4691 regarding this, and I plan on creating a PR for this. I think this is very important.

So for now pining to commit hash is for me mandatory best practice in terms of supply chain security but currently hard to challenging to read.

Again, my PR will bring the renovate feature to dependabot too!

with:
node-version: ${{matrix.nodeversion}}
registry-url: ${{env.NPM_REGISTRY_URL}}
Expand Down