Skip to content

Bump the actions group across 1 directory with 5 updates - #330

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/dot-github/workflows/actions-a6cf181697
Open

Bump the actions group across 1 directory with 5 updates#330
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/dot-github/workflows/actions-a6cf181697

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the actions group with 5 updates in the /.github/workflows directory:

Package From To
scientific-python/action-check-changelogfile 0.3 0.5
actions/checkout 7.0.0 7.0.1
OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml 3.0.1 3.0.3
OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml 3.0.1 3.0.3
pypa/gh-action-pypi-publish 1.14.0 1.14.2

Updates scientific-python/action-check-changelogfile from 0.3 to 0.5

Release notes

Sourced from scientific-python/action-check-changelogfile's releases.

0.5

What's Changed

Full Changelog: scientific-python/action-check-changelogfile@0.4...0.5

0.4

What's Changed

Full Changelog: scientific-python/action-check-changelogfile@0.3...0.4

Commits
  • 9273514 Merge pull request #41 from bsipocz/update_dockerfile
  • 6901e59 Use the actual dependencies
  • d6ceebb Updating the entrypoint, too
  • c283dbe Following the example of the towncrier action
  • 8d73bc1 Update python versions (#39)
  • 95466aa Merge pull request #40 from pllim/gh-token
  • 3e0ebac Fix syntax error
  • 6dbf516 Use PyGithub Auth API
  • 907be5c Merge pull request #37 from scientific-python/dependabot/github_actions/dot-g...
  • d33c963 Bump the actions group in /.github/workflows with 2 updates
  • Additional commits viewable in compare view

Updates actions/checkout from 7.0.0 to 7.0.1

Release notes

Sourced from actions/checkout's releases.

v7.0.1

What's Changed

Full Changelog: actions/checkout@v7...v7.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.1

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Updates OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml from 3.0.1 to 3.0.3

Release notes

Sourced from OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml's releases.

v3.0.3

What's Changed

Full Changelog: OpenAstronomy/github-actions-workflows@v3.0.2...v3.0.3

v3.0.2

What's Changed

Full Changelog: OpenAstronomy/github-actions-workflows@v3...v3.0.2

Commits
  • 22ddf09 Merge pull request #421 from OpenAstronomy/dependabot/github_actions/dot-gith...
  • 1611b98 Bump the actions group across 1 directory with 8 updates
  • 158acf5 Specify name for job which is expected to fail
  • f159b68 DEP: upgrade cibw (4.0.0 -> 4.2.0) (#420)
  • 06db25f [pre-commit.ci] pre-commit autoupdate (#408)
  • d411b3b DEP: upgrade pypa/gh-action-pypi-publish (support Metadata 2.5) (#418)
  • 8db492e MNT: fix a typo in a workflow step name (#415)
  • 2ee1c83 STY: pin ruff version exactly and fix new violations in v0.16.0 (#411)
  • 118a532 DEP: ensure coverage is installed with toml support (#417)
  • 8c8bb6c DEP: allow running python helper scripts with any Python 3.12.x patch version...
  • See full diff in compare view

Updates OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml from 3.0.1 to 3.0.3

Release notes

Sourced from OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml's releases.

v3.0.3

What's Changed

Full Changelog: OpenAstronomy/github-actions-workflows@v3.0.2...v3.0.3

v3.0.2

What's Changed

Full Changelog: OpenAstronomy/github-actions-workflows@v3...v3.0.2

Commits
  • 22ddf09 Merge pull request #421 from OpenAstronomy/dependabot/github_actions/dot-gith...
  • 1611b98 Bump the actions group across 1 directory with 8 updates
  • 158acf5 Specify name for job which is expected to fail
  • f159b68 DEP: upgrade cibw (4.0.0 -> 4.2.0) (#420)
  • 06db25f [pre-commit.ci] pre-commit autoupdate (#408)
  • d411b3b DEP: upgrade pypa/gh-action-pypi-publish (support Metadata 2.5) (#418)
  • 8db492e MNT: fix a typo in a workflow step name (#415)
  • 2ee1c83 STY: pin ruff version exactly and fix new violations in v0.16.0 (#411)
  • 118a532 DEP: ensure coverage is installed with toml support (#417)
  • 8c8bb6c DEP: allow running python helper scripts with any Python 3.12.x patch version...
  • See full diff in compare view

Updates pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.

Over the course of investigation, @​facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.

Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.

🫶 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​davidbrochart💰 and @​Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @​bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @​miketheman💰 confirmed the Warehouse-side details. Also, @​jku💰 and @​woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and [on GitHub][release discussion].

[![GH Sponsors badge]][GH Sponsors URL]

... (truncated)

Commits
  • dc37677 Merge pull request #417 from trail-of-forks/ft/bump-deps
  • 8b2f234 Bump pypi-attestations and sigstore
  • 78b72db Merge pull request #416 from takluyver/twine-v7
  • 92f4d2a Update twine to v7
  • ba38be9 Merge pull request #408 from adisivaprasad/bump-setup-python-v6
  • a6c5088 Bump actions/setup-python from v5.6.0 to v6.2.0
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 1, 2026
@dependabot
Bump the actions group across 1 directory with 5 updates
14cd268 
Bumps the actions group with 5 updates in the /.github/workflows directory:

| Package | From | To |
| --- | --- | --- |
| [scientific-python/action-check-changelogfile](https://github.com/scientific-python/action-check-changelogfile) | `0.3` | `0.5` |
| [actions/checkout](https://github.com/actions/checkout) | `7.0.0` | `7.0.1` |
| [OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml](https://github.com/openastronomy/github-actions-workflows) | `3.0.1` | `3.0.3` |
| [OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml](https://github.com/openastronomy/github-actions-workflows) | `3.0.1` | `3.0.3` |
| [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) | `1.14.0` | `1.14.2` |



Updates `scientific-python/action-check-changelogfile` from 0.3 to 0.5
- [Release notes](https://github.com/scientific-python/action-check-changelogfile/releases)
- [Commits](scientific-python/action-check-changelogfile@1fc669d...9273514)

Updates `actions/checkout` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)

Updates `OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml` from 3.0.1 to 3.0.3
- [Release notes](https://github.com/openastronomy/github-actions-workflows/releases)
- [Commits](OpenAstronomy/github-actions-workflows@e5af21e...22ddf09)

Updates `OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml` from 3.0.1 to 3.0.3
- [Release notes](https://github.com/openastronomy/github-actions-workflows/releases)
- [Commits](OpenAstronomy/github-actions-workflows@e5af21e...22ddf09)

Updates `pypa/gh-action-pypi-publish` from 1.14.0 to 1.14.2
- [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases)
- [Commits](pypa/gh-action-pypi-publish@cef2210...dc37677)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: pypa/gh-action-pypi-publish
  dependency-version: 1.14.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: scientific-python/action-check-changelogfile
  dependency-version: '0.5'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the actions group in /.github/workflows with 5 updates Bump the actions group across 1 directory with 5 updates Sep 1, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/dot-github/workflows/actions-a6cf181697 branch from 56d898c to 14cd268 Compare September 1, 2026 00:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants