NO-JIRA: ci(deps): bump actions/setup-python from 6.2.0 to 7.0.0 - #9089
Conversation
dependabot
Bot
added
area/ci-tooling
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
📝 WalkthroughWalkthroughThe reusable documentation workflow updates its pinned Suggested reviewers: 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/docs-build-reusable.yaml:
- Around line 18-21: Remove the unsupported pip-install input from the
actions/setup-python step and add a separate shell step running python -m pip
install -r docs/requirements.txt before the mkdocs build step in the workflow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 04275200-df1b-4b1d-b82e-8c6278d47b4d
📒 Files selected for processing (1)
.github/workflows/docs-build-reusable.yaml
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | ||
| with: | ||
| python-version: '3.x' | ||
| pip-install: '-r docs/requirements.txt' |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow snippet =="
cat -n .github/workflows/docs-build-reusable.yaml | sed -n '1,80p'
echo
echo "== search for pip-install usage =="
rg -n "pip-install|setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97" .github/workflows . -g '!**/.git/**'
echo
echo "== pinned action metadata =="
python3 - <<'PY'
import urllib.request
url = "https://raw.githubusercontent.com/actions/setup-python/5fda3b95a4ea91299a34e894583c3862153e4b97/action.yml"
print(urllib.request.urlopen(url, timeout=20).read().decode())
PYRepository: openshift/hypershift
Length of output: 4226
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
import ssl, urllib.request
url = "https://raw.githubusercontent.com/actions/setup-python/5fda3b95a4ea91299a34e894583c3862153e4b97/action.yml"
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
print(urllib.request.urlopen(url, context=ctx, timeout=20).read().decode())
PYRepository: openshift/hypershift
Length of output: 2661
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== docs requirements =="
if [ -f docs/requirements.txt ]; then
cat -n docs/requirements.txt
else
echo "docs/requirements.txt not found"
fi
echo
echo "== docs workflow references =="
rg -n "mkdocs|pip install|requirements.txt|setup-python|pip-install|pip-version" .github/workflows docs -g '!**/.git/**'
echo
echo "== workflow files under docs build =="
git ls-files .github/workflows | sed -n '/docs/p'Repository: openshift/hypershift
Length of output: 3399
Install docs dependencies explicitly
actions/setup-python does not accept pip-install, so line 21 is a no-op. Add a separate python -m pip install -r docs/requirements.txt step before mkdocs build.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 21-21: usage of GitHub Actions misfeatures (misfeature): installs packages in a brittle manner
(misfeature)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/docs-build-reusable.yaml around lines 18 - 21, Remove the
unsupported pip-install input from the actions/setup-python step and add a
separate shell step running python -m pip install -r docs/requirements.txt
before the mkdocs build step in the workflow.
|
Hi @dependabot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6.2.0 to 7.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@a309ff8...5fda3b9 7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
f71fd4b to
9c3cbe7
Compare
|
@dependabot[bot]: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/retitle NO-JIRA: ci(deps): bump actions/setup-python from 6.2.0 to 7.0.0 |
openshift-ci
Bot
changed the title
openshift-ci-robot
added
jira/valid-reference
|
@dependabot[bot]: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@mgencur: The DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Pipeline controller notification No second-stage tests were triggered for this PR. This can happen when:
Use |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dependabot[bot], muraee The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
actions/setup-python removed the pip-install input in v7.0.0 (it installed into the global environment, conflicted with virtualenvs and tools like uv, and wasn't picked up by Dependabot). Since this workflow was already pinned to v7.0.0, its pip-install: '-r docs/requirements.txt' input silently became a no-op, meaning docs dependencies were never actually installed here. Replace it with an explicit "pip install -r docs/requirements.txt" step, matching the fix already proposed in openshift#9133. Also watch docs-build-reusable.yaml in docs-build.yaml's paths filter. That filter only watched docs/** and its own file, not the reusable workflow it calls, which is how this exact breakage (from PR openshift#9089's actions/setup-python bump) slipped through unnoticed: the Docs Build check never ran on that PR since the file it changed wasn't in the filter. Every other trigger/-reusable workflow pair in this repo already references its reusable file in the paths filter; this was an isolated gap specific to docs-build.yaml.
3 participants
Bumps actions/setup-python from 6.2.0 to 7.0.0.
Release notes
Sourced from actions/setup-python's releases.
Commits
5fda3b9Pin SHA commits and update docs with latest versions (#1338)4ab7e95Merge pull request #1337 from actions/philip-gai/bump-actions-cache-6-2-00f3a009Remove the pip-install input (#1336)f8cf429Migrate to ESM and upgrade dependencies (#1330)54baeeaValidate and retry manifest fetch to prevent silent failures (#1332)c709277Annotation code fix (#1335)6849080remove EOL Python versions and Bumps numpy text fixture (#1333)0903b46Bump certifi from 2020.6.20 to 2024.7.4 in /tests/data (#1328)ece7cb0Fix pip cache error handling on Windows. (#1040)1d18d7aUpdate advanced-usage.md (#811)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit