fix(release): repoint 6 orphaned gha-release-* action pins crashing Dependabot#336
Merged
Merged
Conversation
…ependabot
reusable-release.yml pinned gha-release-python/docker/go/rust/frontend and
gha-package-assets to SHAs labelled v2.0.x / v1.2.0 — tags that were never
published. Those commits are unreachable from any tag, so Dependabot's
github_actions updater crashed ("no such commit ...") on the first one
(gha-release-python@f3105cab). Because github_actions is part of the
multi-ecosystem-group "dependencies", that crash blocked ALL grouped
version-update PRs — none created since 2026-06-04. Repinned each to its
latest real release (v1.0.3, package-assets v1.1.5).
Diagnosed from the Dependabot dynamic run logs (job_1471642895).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013vU67T2LJDCbYTBs9ZFAf2
jdfalk
added a commit
that referenced
this pull request
Jul 21, 2026
…ot-firewall The pip entry only scanned '/', so scripts/requirements-notifications.txt and scripts/copilot-firewall/requirements.txt got no update PRs (the latter's Pygments alert had no path to a fix). Switched directory:/ to a directories list covering all three tracked pip manifests. Also forces a fresh Dependabot re-registration, confirming the github_actions job no longer crashes after #336. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013vU67T2LJDCbYTBs9ZFAf2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause (this is why Dependabot stopped opening PRs)
Diagnosed from the Dependabot dynamic run logs (visible in Actions as
dynamicevents — thanks to that pointer). Jobjob_1471642895(github_actions in /. - Update) crashed:reusable-release.ymlpinned six first-party actions to commit SHAs labelled# v2.0.x/# v1.2.0— tags that were never published (all 404). Those commits are unreachable from any tag, so Dependabot'sgithub_actionsupdater crashes trying to resolve them. Becausegithub_actionsis part of themulti-ecosystem-group: dependencies, that single crash blocks the entire grouped version-update PR — which is why zero version-update PRs have been created since 2026-06-04 (#289).GitHub Actions itself tolerates the orphaned SHAs (it fetches the exact commit), so releases kept working — only Dependabot choked, silently.
Fix
Repoint each to its latest real release:
# v2.0.0a6acf4ec# v1.0.3# v2.0.0f2775359# v1.0.3# v2.0.1cf4aea67# v1.0.3# v2.0.09cdb217e# v1.0.3# v2.0.0731cf92c# v1.0.3# v1.2.0a55b9a19# v1.1.5Not a downgrade — those v2 tags never existed; v1.0.3 / v1.1.5 are each action's current latest release (chronologically newer than the orphaned SHAs).
The remaining stale-but-valid pins (protobuf, detect-languages, docs-generator) point to real tags and will be bumped by Dependabot itself once this unblocks it.
🤖 Generated with Claude Code