Skip to content

chore(deps): pin dependencies #180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): pin dependencies #180

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,10 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

- name: Setup Node
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version-file: .nvmrc

Expand All @@ -43,7 +43,7 @@ jobs:
fi

@sentry sentry Bot Feb 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The workflow references a non-existent step pr to set the BASE_REF variable. This results in an empty string, causing the subsequent git rev-list command to fail.
Severity: HIGH

Suggested Fix

The environment variable BASE_REF is being set from a non-existent step output. To fix this, replace ${{ steps.pr.outputs.base_ref }} with the correct GitHub Actions context variable to obtain the base branch name. For workflows triggered by pull requests, github.base_ref is typically used. Ensure the variable provides a valid branch name to the git rev-list command.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: .github/workflows/build.yaml#L43

Potential issue: The `build.yaml` workflow sets the `BASE_REF` environment variable
using the output of a step with `id: pr`. However, no such step exists in the workflow.
As a result, `BASE_REF` is assigned an empty string. This empty value is then used in
the "Check if commit exists" step within a `git rev-list` command, forming an invalid
git range `origin/..HEAD`. Because the script is configured with `set -eu`, this invalid
command will cause the step to fail, halting the workflow. This failure will occur on
every run triggered by pushes to `renovate/**` or `dependabot/**` branches, breaking the
CI process for automated dependency updates.

Did we get this right? 👍 / 👎 to inform future reviews.


- name: Commit chart version
uses: stefanzweifel/git-auto-commit-action@v6
uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6
if: steps.commit_exists.outputs.result == 'false'
with:
commit_message: ${{ env.COMMIT_MESSAGE }}
22 changes: 11 additions & 11 deletions .github/workflows/tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,9 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- name: Setup Node
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version-file: .nvmrc
- name: Install Dependencies
Expand All @@ -23,9 +23,9 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- name: Setup Node
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version-file: .nvmrc
- name: Install Dependencies
Expand All @@ -38,9 +38,9 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- name: Setup Node
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
with:
node-version-file: .nvmrc
- name: Install Dependencies
Expand All @@ -55,7 +55,7 @@ jobs:
matrix: ${{ steps.gen-matrix.outputs.matrix }}
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- name: Generate Matrix
uses: ./
id: gen-matrix
Expand Down Expand Up @@ -86,14 +86,14 @@ jobs:
contents: write
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with:
fetch-depth: 0
- name: Generate Changelog
id: changelog
uses: gabe565/changelog-generator@v1
uses: gabe565/changelog-generator@733bb2c02fab0bb0e2dd9a059e0dc9f668d05c95 # v1
- name: Release
uses: softprops/action-gh-release@v2
uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
with:
body: ${{ steps.changelog.outputs.changelog }}
- uses: nowactions/update-majorver@v1
- uses: nowactions/update-majorver@f2014bbbba95b635e990ce512c5653bd0f4753fb # v1
Loading