ci(api-docs/rust,cpp): bump the last two stale template pins - #136
Conversation
The rust and cpp api-docs templates still pinned actions/checkout v6.0.2 and peter-evans/create-pull-request v7.0.8. Their consumers (crates, vcpkg) have been on v7.0.1 and v8.1.1 since Dependabot bumped them in June and July. sync-templates.sh does a wholesale `cp` of the template over the consumer's workflow, so a sync today would have walked both repos back a major on both actions. The templates live in automation/source-repo-templates/, outside .github/workflows/ — the only path Dependabot's github-actions ecosystem scans — so they get no bump PRs while consumers drift forward weekly. Pins only. Diffed against both consumers' live workflows first: the pin lines were the sole divergence, so there was no downstream-only logic to rescue, unlike the npm and pypi cache-poisoning mitigations recovered in PRs 134 and 135. Both templates are now byte-identical to the file each consumer runs.
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughBoth API documentation workflow templates update pinned versions of ChangesAPI documentation workflow action updates
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Other Merge Risk: ⚪ Minimal · up to The documentation templates receive updated action pins without changing workflow behavior; no merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
What
Bumps the three stale action pins in each of the two remaining api-docs
templates —
api-docs.rust.ymlandapi-docs.cpp.yml. Pins only; no otherline in either file changes.
actions/checkoutde0fac2e…v6.0.23d3c42e5…v7.0.1peter-evans/create-pull-request271a8d03…v7.0.85f6978fa…v8.1.1This finishes what #134 (typescript) and #135 (python) started. Built on
current
main, with both merged.Why these templates rot
Dependabot's
github-actionsecosystem only scans.github/workflows/and.github/actions/. This repo'sdependabot.ymldeclaresdirectory: /withpatterns: ["*"], which reads as "everything" but does not widen that scan —automation/source-repo-templates/is invisible to it. The templates havetherefore never received a bump PR.
The consumers do get Dependabot, and have been drifting forward weekly. Live
pins on each consumer's default branch today:
checkoutcreate-pull-requestnpmpypicratesvcpkgdotnet-sdkThe same split shows inside this repo:
lychee.ymlruns checkout v7.0.1 andchangelog-sync.ymlruns v7.0.0 + create-pull-request v8.1.1, while thetemplates sitting a few directories away named v6.0.2 and v7.0.8. Same repo,
same Dependabot config, opposite freshness.
That matters because
automation/sync-templates.shdoes a wholesalecp "$template_path" "$target_workflow"— it replaces the consumer's filerather than merging into it. Running the sync before this PR would have walked
cratesandvcpkgback a major on both actions.Divergence audit (before bumping)
Each template was diffed against the live
.github/workflows/api-docs.ymlonits consumer's default branch, taken from the mapping in
sync-templates.sh(
rust → crates@master,cpp → vcpkg@main).Both diffs were exactly three hunks, all of them pin lines. No
downstream-only logic of any kind — no security mitigation, no bug fix, no
comment carrying rationale. Nothing to rescue upstream, and nothing the blind
cpwould have destroyed beyond the pins themselves.This is a genuinely different result from #134 and #135, and the reason is
structural rather than luck: those templates call
setup-bunandsetup-uv,cache-populating actions, which is what made
no-cache: truenecessarydownstream. The rust and cpp templates call no caching action at all — their
only
uses:steps are the two checkouts and create-pull-request. The oneoccurrence of the word "cache" in either file is a comment about the runner's
tool cache, identical on both sides. So the cache-poisoning class that
produced the downstream fixes in npm and pypi has no surface here.
After the bump,
diffbetween each template and its consumer's live workflowis empty — byte-identical. The next sync is a no-op for both repos.
Major-version review
Both bumps cross a major, so the input surface of each was parsed out of
action.ymlat the new pinned SHA and checked against what the templatesactually pass. Both templates pass identical input sets.
actions/checkoutv6.0.2 → v7.0.1. The templates pass 5 of the 21inputs v7.0.1 declares —
ref,persist-credentials(source checkout);repository,path,token,persist-credentials(docs checkout). All fiveare declared in v7.0.1. No input or output was removed across the major; one
was added (
allow-unsafe-pr-checkout, defaultfalse).That new input is the whole of v7.0.0's breaking change: it blocks checking out
fork PR code under
pull_request_targetandworkflow_run. Neither templateuses either trigger — both are
workflow_dispatch+push: tags— so the gatedoes not engage. The rest of v7.0.0 is an ESM/dependency refresh.
peter-evans/create-pull-requestv7.0.8 → v8.1.1. The templates pass12 of the 24 inputs v8.1.1 declares —
add-paths,author,base,body,branch,commit-message,committer,delete-branch,labels,path,title,token. All 12 are declared in v8.1.1.The
action.ymldiff between the two SHAs is a single line:using: node20→
using: node24. Identical input names, identical outputs, no defaultchanged. v8.0.0's release notes name one requirement — Actions Runner v2.327.1
or later, and only for self-hosted runners. Both templates are
runs-on: ubuntu-latest. Neither template consumes any output of these steps(no step
id:is set anywhere in either file), so the unchanged output set isbelt-and-braces.
Evidence from the consumers
cratesandvcpkghave each run this exact workflow green on 2026-07-27, atcheckout v7.0.0 and create-pull-request v8.1.1. So v8.1.1 is proven in
production for both. The checkout v7.0.1 patch landed the day after
(
crates2026-07-28,vcpkg2026-07-31) and has not had a workflow runyet on either repo — stated plainly rather than implied. It is the SHA all four
Dependabot-managed consumers carry today, and
lychee.ymlin this repo alreadyruns it.
Verification
git ls-remote --tagsagainst the upstream repo,in both directions, old and new. All four agree with their version comments —
no repeat of the mismatch class fixed in fix(dotnet-docs): scan all .csproj candidates for a real version #56. All four tags are lightweight,
so the listed SHA is the commit SHA, not a tag object.
checkout's tag list ends at v7.0.1, create-pull-request's at v8.1.1.
actionlintexits 0 on both edited files and on all five templates,with
shellcheckintegration active.Follow-ups, not in this PR
gets no automated updates and will drift again. ci(api-docs/ts): bring npm's cache-poisoning fix upstream, reconcile the rest #134 raised this; it remains
the right structural fix.
dotnet-sdkhas no.github/dependabot.ymlat all (404). That is whyit alone among the consumers is still on v6.0.2/v7.0.8, and why the dotnet
template's stale pins have not caused a visible regression — both sides are
equally stale. The dotnet template is separately ahead of its consumer by
the whole of fix(api-docs/dotnet): read package versions from MSBuild, not a csproj regex #133, which has not been synced down.
affect these two files: neither carries a copyright header.
Test plan
confirmed as the only divergence
git ls-remote --tags; tag objects ruled outaction.ymlat the new SHAfull
action.ymldiff readpull_request_target/workflow_rungateactionlintclean on both edited files and all five templatescratesandvcpkgand confirm the next release-tag run is greenSummary by CodeRabbit