chore(deps): bump r-lib/actions/setup-pandoc from 2.12.1 to 2.13.0 - #89
Open
dependabot[bot] wants to merge 1 commit into
Open
chore(deps): bump r-lib/actions/setup-pandoc from 2.12.1 to 2.13.0#89dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [r-lib/actions/setup-pandoc](https://github.com/r-lib/actions) from 2.12.1 to 2.13.0. - [Release notes](https://github.com/r-lib/actions/releases) - [Changelog](https://github.com/r-lib/actions/blob/v2-branch/NEWS.md) - [Commits](r-lib/actions@d3c5be5...465b7d8) --- updated-dependencies: - dependency-name: r-lib/actions/setup-pandoc dependency-version: 2.13.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
|
|
||
| - uses: r-lib/actions/setup-pandoc@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 | ||
| - uses: r-lib/actions/setup-pandoc@465b7d8e732ca3921382b1674c59bada9cbf3399 # v2 |
There was a problem hiding this comment.
📝 Info: Executable action payload is unchanged
The action metadata and executable bundle are byte-identical at both commits. This workflow’s Pandoc setup behavior remains unchanged.
Was this helpful? React with 👍 or 👎 to provide feedback.
![cwl-noema-review[bot]](https://avatars.githubusercontent.com/u/295022177?s=60&v=4){kind=small}
There was a problem hiding this comment.
Noema LLM review
The PR updates the pinned SHA for r-lib/actions/setup-pandoc from d3c5be51b12e724e68f33216ca3c148b66d5f0b6 to 465b7d8e732ca3921382b1674c59bada9cbf3399, corresponding to the v2 tag bump from 2.12.1 to 2.13.0. The prior review thread confirms the action metadata and executable bundle are byte-identical at both commits, so no behavioral change is introduced. The workflow remains valid YAML, permissions are unchanged (contents: read), and all other steps are untouched.
Reviewed changed lines
.github/workflows/R-CMD-check.yaml:37 (RIGHT): The setup-pandoc SHA is updated from d3c5be51b12e724e68f33216ca3c148b66d5f0b6 to 465b7d8e732ca3921382b1674c59bada9cbf3399. The new SHA resolves to the upstream r-lib/actions v2.13.0 tag, and prior review confirms byte-identical action metadata and executable bundle, so no functional change occurs.
Adversarial validation
.github/workflows/R-CMD-check.yaml:37 (RIGHT)falsified: The updated SHA might not resolve to the intended upstream tag or could introduce a supply-chain or behavioral change. — The SHA 465b7d8e732ca3921382b1674c59bada9cbf3399 corresponds to the v2.13.0 tag commit, and prior review threads state the action metadata and executable bundle are byte-identical at both commits..github/workflows/R-CMD-check.yaml:37 (RIGHT)falsified: The version bump could break compatibility with downstream steps that rely on setup-pandoc outputs or specific behavior. — setup-pandoc is invoked without inputs, its outputs are not consumed by downstream steps, and setup-r, setup-r-dependencies, and check-r-package remain pinned to compatible v2-era SHAs.- Residual risk: Negligible: the changed SHA resolves to the upstream v2.13.0 tag and the executable payload is byte-identical to the prior pinned commit.
Findings
- No blocking findings.
- Result: APPROVE
- Head SHA:
806ca9a67258244cf63c5668eaa5c1ad87ded8cc - Reviewer credential:
noema-review-github-app-refresh - Actor:
cwl-noema-review[bot]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps r-lib/actions/setup-pandoc from 2.12.1 to 2.13.0.
Changelog
Sourced from r-lib/actions/setup-pandoc's changelog.
... (truncated)
Commits
465b7d8NEWS for 2.13.0 (#1105)d06a540[setup-r] retry transient r-hub.io request failures (#1088)ed9aa85fix(setup-r): export correct RTOOLS HOME env vars on Windows ARM64 and x64 (#...c86f32csetup-r-dependencies: set JAVA_HOME on Windows runners from Java 21 env vars ...2a66450setup-r-dependencies: switch back to classic sudo on runners with sudo-rs (#1...5cc1f0dFix minor typo (#1098)33d09fbfix: Remove stray::group::(#1103)aae88a2Special-case CRAN mirror for Windows ARM64 (#1101)b7484da[setup-r] Support installing RTools without installing R (#1093)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)