Conversation
Bumps [runs-on/action](https://github.com/runs-on/action) from 2.2.0 to 2.3.0. - [Release notes](https://github.com/runs-on/action/releases) - [Commits](runs-on/action@4e5f723...46910bf) --- updated-dependencies: - dependency-name: runs-on/action dependency-version: 2.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
the
github_actions
potiuk
left a comment
potiuk
left a comment
There was a problem hiding this comment.
Reviewed. node24 action, v2.2.0 -> v2.3.0. verify passes with every check green: compiled JS matches the rebuild, no binary downloads, lock file present.
The in-tree binary check is the interesting one here: 3 binaries verified via gh attestation (SLSA provenance). This is the action that originally failed that check hard for shipping unattested Go binaries; the actions/attest-build-provenance wiring the maintainer added in runs-on/action#37 is still holding two minor versions later.
The red check_action_tags is a repo-level failure, not caused by this PR. dtolnay/rust-toolchain was annotated tag: stable, a rolling branch that upstream force-pushes, so the pinned SHA stopped being an ancestor of it and the check hard-failed on every open PR. Fixed in #1163.
Approving.
Drafted-by: Claude Opus 5 (1M context) via Claude Code; reviewed by @potiuk before posting
1 participant
Bumps runs-on/action from 2.2.0 to 2.3.0.
Release notes
Sourced from runs-on/action's releases.
Commits
46910bfdist: rebuild binaries for v2.3.0f729357Merge branch 'main' into v202347f1Bump README to v2.3.03321413Rebuild action binaries10fb12cAllow verified Windows sticky mount roots6377b28Refactor sticky cache runtime state (#46)76f7eafdist: rebuild binariesbaa006cAuthenticate read-only Git LFS lock requestsd5c5d9fRebuild action binariesfd25aafFix warm cache symlink mergesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)