chore(deps): update actions/configure-pages action to v6 - autoclosed - #6
Closed
tannevaled wants to merge 1 commit into
Closed
chore(deps): update actions/configure-pages action to v6 - autoclosed#6tannevaled wants to merge 1 commit into
tannevaled wants to merge 1 commit into
Conversation
tannevaled
added a commit
that referenced
this pull request
Aug 30, 2026
The Pages workflow triggered on `push` to main and `workflow_dispatch` only, so nothing ran on a pull request. Measured, not assumed: the two open Renovate pull requests here (#6 bumping actions/configure-pages, #7 bumping actions/deploy-pages) both report `total_count: 0` from `/repos/go-pdfkit/go-pdfkit.github.io/commits/<sha>/check-runs`. A change to the very workflow that publishes the site was mergeable with nothing verifying it, and the first evidence of a mistake would have been a broken published site. Add a `pull_request` trigger so the build job proves the site still builds, and gate the deploy job on the event so a pull request never publishes. Permissions and concurrency follow from that: - the workflow now grants `contents: read` and `pages: read` only. `pages: write` and `id-token: write` move down to the deploy job, which is the only job that needs them; a pull request build therefore cannot publish even if a step in it misbehaves. `configure-pages` runs in the build job and reads the Pages settings to compute the base URL, which `pages: read` covers. - the concurrency group is scoped by ref. Deploys still serialise with one another under the main group, while each pull request gets a group of its own so it neither waits behind a deploy nor holds one up, and a new push to the same pull request supersedes the build still running for it. The action versions are deliberately left alone: pull requests #6 and #7 exist to bump them, and they are now the proof that the check actually appears. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
tannevaled
added a commit
that referenced
this pull request
Aug 30, 2026
Renovate proposed both (#6, #7) against a workflow that ran on no pull request, so neither carried a single check: `total_count: 0` on both head commits. They are applied here instead, on top of the workflow that now builds on a pull request, so that a change to the machinery that publishes the site is proved by the machinery itself before it reaches main. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Contributor
Author
|
Superseded by #9, which is merged: the workflow is on Leaving this open for Renovate to close by itself on its next run. Closing a Renovate PR by hand is permanent — it is read as "never propose this again", which would silently block every future bump of these actions. That is a worse outcome than a PR sitting here for a few hours. Worth recording why this one carried no checks: the workflow it edits ran only on |
tannevaled
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v5→v6Release Notes
actions/configure-pages (actions/configure-pages)
v6.0.0Compare Source
Changelog
See details of all code changes since previous release.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.