chore(deps): bump amannn/action-semantic-pull-request from 5 to 6 in the actions group - #87
Conversation
Bumps the actions group with 1 update: [amannn/action-semantic-pull-request](https://github.com/amannn/action-semantic-pull-request). Updates `amannn/action-semantic-pull-request` from 5 to 6 - [Release notes](https://github.com/amannn/action-semantic-pull-request/releases) - [Changelog](https://github.com/amannn/action-semantic-pull-request/blob/main/CHANGELOG.md) - [Commits](amannn/action-semantic-pull-request@v5...v6) --- updated-dependencies: - dependency-name: amannn/action-semantic-pull-request dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
📝 WalkthroughWalkthroughThe PR updates the GitHub Actions workflow that lints pull request titles. The ChangesPR Title Linting
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/pr-title.yml (1)
17-17: ⚡ Quick winConsider pinning the action to a commit SHA.
The static analysis tool flags that the action reference should be pinned to a commit SHA rather than a mutable tag. While this PR continues the existing pattern of using semantic version tags, pinning to a specific commit hash improves supply chain security by ensuring the action code cannot change unexpectedly.
🔒 Suggested approach for SHA pinning
After verifying v6 works correctly, you can pin to the specific commit SHA for v6.0.0:
- Find the commit SHA for the v6.0.0 tag in the action's repository
- Update the reference to:
uses: amannn/action-semantic-pull-request@<commit-sha> # v6.0.0- Add a comment with the version for maintainability
This can be done in a follow-up PR if you prefer to validate v6 functionality first.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-title.yml at line 17, Replace the mutable tag reference for the GitHub Action used in the workflow (the line using amannn/action-semantic-pull-request@v6) with a pinned commit SHA for the v6 release; locate the commit SHA for the v6.0.0 tag in the action's repository, update the uses entry to amannn/action-semantic-pull-request@<commit-sha>, and add an inline comment preserving the tag/version (e.g., "# v6.0.0") so maintainers can see which release the SHA corresponds to.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-title.yml:
- Line 17: Replace the mutable tag reference to the GitHub Action in the
workflow (the line using amannn/action-semantic-pull-request@v6) with a pinned
commit SHA (amannn/action-semantic-pull-request@<commit-sha>) to avoid floating
updates; locate the uses: amannn/action-semantic-pull-request@v6 entry in the PR
title workflow and swap the tag for the specific commit SHA from the action's
repo, then run/check the workflow to confirm compatibility with Node.js 24 on
GitHub-hosted runners.
---
Nitpick comments:
In @.github/workflows/pr-title.yml:
- Line 17: Replace the mutable tag reference for the GitHub Action used in the
workflow (the line using amannn/action-semantic-pull-request@v6) with a pinned
commit SHA for the v6 release; locate the commit SHA for the v6.0.0 tag in the
action's repository, update the uses entry to
amannn/action-semantic-pull-request@<commit-sha>, and add an inline comment
preserving the tag/version (e.g., "# v6.0.0") so maintainers can see which
release the SHA corresponds to.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 08300eeb-6fec-4d6b-8a83-9d9780ef69cc
📒 Files selected for processing (1)
.github/workflows/pr-title.yml
| # Lints the PR TITLE only, which is correct: squash-merge means only | ||
| # the title lands on main. | ||
| - uses: amannn/action-semantic-pull-request@v5 | ||
| - uses: amannn/action-semantic-pull-request@v6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check the action repository for Node.js version requirements and compatibility
# Check the action.yml or package.json in the repository to confirm Node.js version
gh api repos/amannn/action-semantic-pull-request/contents/action.yml --jq '.content' | base64 -d | grep -i "node" || echo "No Node.js version found in action.yml"
# Search for any issues related to Node.js 24 compatibility
gh search issues --repo amannn/action-semantic-pull-request "Node.js 24 OR node 24 OR nodejs 24" --limit 5 --json title,url,state | jq -r '.[] | "\(.state | ascii_upcase): \(.title)\n \(.url)"'Repository: Oszkar/oto
Length of output: 72
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Fetch and display the relevant part of action.yml that declares the runtime (node24)
gh api repos/amannn/action-semantic-pull-request/contents/action.yml --jq '.content' | base64 -d | sed -n '1,200p' | rg -n "using:|node24|runs:" -n || trueRepository: Oszkar/oto
Length of output: 82
🌐 Web query:
GitHub Actions hosted runners Node.js 24 support date node24
💡 Result:
Node.js 24 is supported on GitHub Actions hosted runners [1][2]. The transition to making Node.js 24 the default version for JavaScript actions is scheduled for June 16, 2026 [3][1]. Key details regarding Node.js support and the migration: Migration Schedule: Beginning June 16, 2026, GitHub Actions runners will automatically begin using Node.js 24 by default for JavaScript/TypeScript actions [3][1]. Opting Out: To continue using Node.js 20 after this date, users can set the environment variable ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true in their workflow or on the runner machine [1][4]. Note that this is a temporary measure, as Node.js 20 has reached end-of-life (EOL) and will eventually be fully removed from support [1][5]. Pre-installed Versions: As of May 2026, Node.js 20 has been removed from the toolcache on GitHub-hosted runner images [5][6]. Pre-installed versions on most runner images are now Node.js 22 and Node.js 24 [5][6]. Linux ARM32 Limitation: Node.js 24 does not support Linux ARM32 [1][4]. Self-hosted runners on this architecture will not support Node.js 24 [1]. Best Practice: It is recommended to use the actions/setup-node action to explicitly define the Node.js version required by your workflow, rather than relying on the runner's default version [7][8]. This ensures consistent behavior regardless of changes to the runner environment [8].
Citations:
- 1: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
- 2: Runner Support for executing Node24 Actions actions/runner#3940
- 3: Update Node 24 default date to June 16th, 2026 actions/runner#4462
- 4: Node 20 -> Node 24 migration feature flagging, opt-in and opt-out environment variables actions/runner#3948
- 5: [All OS] Default Node.js version will be changed from 20 to 22 and Node.js 20 will be removed from runner images actions/runner-images#14029
- 6: [All OS] Default Node.js version changed from 20 to 22. Node.js 20 removed actions/runner-images#14046
- 7: Update/Add NodeJS 24 actions/runner-images#12477
- 8: https://github.com/actions/setup-node
Pin the action SHA; Node.js 24 should be OK on GitHub-hosted runners
amannn/action-semantic-pull-requestdeclaresruns.using: node24, and GitHub-hosted runners already have Node.js 24 available (defaulting to it on June 16, 2026); only Linux ARM32 self-hosted runners would be impacted.- zizmor flags
amannn/action-semantic-pull-request@v6as unpinned—pin to a specific commit SHA instead of the mutablev6tag.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-title.yml at line 17, Replace the mutable tag reference
to the GitHub Action in the workflow (the line using
amannn/action-semantic-pull-request@v6) with a pinned commit SHA
(amannn/action-semantic-pull-request@<commit-sha>) to avoid floating updates;
locate the uses: amannn/action-semantic-pull-request@v6 entry in the PR title
workflow and swap the tag for the specific commit SHA from the action's repo,
then run/check the workflow to confirm compatibility with Node.js 24 on
GitHub-hosted runners.
1 participant
Bumps the actions group with 1 update: amannn/action-semantic-pull-request.
Updates
amannn/action-semantic-pull-requestfrom 5 to 6Release notes
Sourced from amannn/action-semantic-pull-request's releases.
... (truncated)
Changelog
Sourced from amannn/action-semantic-pull-request's changelog.
... (truncated)
Commits
48f2562chore: Release 6.1.1 [skip ci]800da4cfix: ParseheaderPatternCorrespondenceproperly (#295)677b895test: Fix broken test24e6f01ci: Fix permissions for tagger7f33ba7chore: Release 6.1.0 [skip ci]afa4edbfix: Remove trailing whitespace from "unknown release type" error message (#291)a30288bfeat: Support providing regexps for types (#292)a46a7c8build: Move Vitest todevDependencies(#290)fdd4d3dchore: Release 6.0.1 [skip ci]58e4ab4fix: Actually execute action (#289)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary by CodeRabbit