chore: update planned Go, Actions, and docs dependencies - #61774
Conversation
Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>
Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>
|
✅ Ponytail Reviewer completed successfully! Warning Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding. What happenedThe threat detection engine failed to produce results. Review the workflow run logs for details. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "ab.chatgpt.com"See Network Configuration for more information.
|
|
No ADR enforcement needed: PR does not have the 'implementation' label and has ≤100 new lines of code in business logic directories.
|
|
Warning Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding. What happenedThe threat detection engine failed to produce results. Review the workflow run logs for details.
|
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅
|
|
✅ Test Quality Sentinel completed test quality analysis. No test files were added or modified in this PR (github/gh-aw #61774 — dependency/lockfile updates for Go modules, GitHub Actions, and docs). Test Quality Sentinel skipped.
|
There was a problem hiding this comment.
🟡 Changes recommended
Mermaid compatibility, an omitted setup-node update, and stale golden snapshots remain unresolved.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Updates planned Go, GitHub Actions, and documentation dependencies across the compiler, CI, and docs toolchain.
Changes:
- Refreshes Go modules and checksums.
- Updates pinned Actions and generated workflows.
- Upgrades Mermaid to v12.
File summaries
| File | Description |
|---|---|
pkg/workflow/data/action_pins.json |
Refreshes compiler action pins. |
pkg/actionpins/data/action_pins.json |
Refreshes embedded action pins. |
go.sum |
Updates module checksums. |
go.mod |
Bumps Go dependencies. |
docs/package.json |
Upgrades Mermaid. |
.github/workflows/workflow-normalizer.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/windows-cli-integration.yml |
Upgrades artifact download. |
.github/workflows/weekly-blog-post-writer.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/static-analysis-report.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/stale-repo-identifier.md |
Updates stale-repos. |
.github/workflows/security-review.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/safe-output-health.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/release.md |
Updates container build Actions. |
.github/workflows/q.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/metrics-collector.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/example-workflow-analyzer.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/docs.yml |
Upgrades Pages artifact upload. |
.github/workflows/dev-hawk.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/daily-storify.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/daily-safe-output-optimizer.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/daily-observability-report.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/daily-model-resolution.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/daily-grader-audit.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/daily-firewall-report.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/daily-evals-report.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/daily-cli-tools-tester.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/daily-ambient-context-optimizer.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/daily-agent-of-the-day-blog-writer.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/CWI.yml |
Upgrades artifact download. |
.github/workflows/copilot-setup-steps.yml |
Upgrades uv setup. |
.github/workflows/ci.yml |
Upgrades artifact download. |
.github/workflows/cgo.yml |
Upgrades artifact download. |
.github/workflows/aw-failure-investigator.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/aoai-endpoint-smoke-test.yml |
Upgrades Azure login. |
.github/workflows/agentic-token-trend-audit.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/agentic-token-audit.lock.yml |
Regenerates the Buildx pin. |
.github/workflows/agent-performance-analyzer.lock.yml |
Regenerates the Buildx pin. |
.github/aw/actions-lock.json |
Refreshes the action registry. |
Review details
Files not reviewed (1)
- docs/package-lock.json: Generated file
- Files reviewed: 60/62 changed files
- Comments generated: 3
- Review effort level: Balanced
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Skills-Based Review 🧠
This is a mechanical dependency-bump PR (Go modules, GitHub Actions pins, docs deps). No new logic, abstractions, or behavior changes are introduced, so /tdd, /codebase-design, and /diagnosing-bugs don't surface any actionable findings — there's nothing to test-drive or architecturally critique here.
📋 Verification performed
- Spot-verified SHA pins against upstream tags for the actions with version jumps:
azure/login@a641126d1...→v3.1.0✅,actions/upload-pages-artifact@fc324d35...→v5.0.0✅,astral-sh/setup-uv@bec219d2...→v10.1.0✅ — all match. .github/aw/actions-lock.json,pkg/actionpins/data/action_pins.json, andpkg/workflow/data/action_pins.jsonare consistently updated fordocker/build-push-action,docker/setup-buildx-action,github/stale-repos, andruby/setup-ruby..lock.ymlregenerations look like straightforward pin propagation (manifest hash + action SHA/version bump only).go.mod/go.sumbumps (x/crypto,x/term,x/tools,modelcontextprotocol/go-sdk, transitivex/net,x/sys,x/telemetry,x/text) are consistent between the two files.- Mermaid v11→v12 bump in
docs/package.jsonis a documented major version jump per the PR description; no code in this repo directly depends on Mermaid's JS API beyond the doc renderer, so risk is low but worth a changelog check if diagram rendering regresses post-merge.
Positive Highlights
- ✅ SHA pins consistently kept in sync with version comments across all lock/data files
- ✅ PR description clearly itemizes the scope of each dependency surface touched
No blocking issues found. Approving.
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 70.9 AIC · ⌖ 15 AIC · ⊞ 10.6K
Comment /matt to run again
|
@copilot this PR still needs forward progress. Failed checks:
Please refresh the branch if needed, investigate the failures, and run the Run: https://github.com/github/gh-aw/actions/runs/35336048090 Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "github.com"See Network Configuration for more information.
|
Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>
Fixed the reproducible |
Updates the planned Dependabot backlog across Go modules, GitHub Actions, and documentation packages. Crypto, MCP tooling, artifact handling, CI setup, and Mermaid compatibility remain isolated within their respective dependency surfaces.
Go modules
x/term,x/crypto,x/tools, andmodelcontextprotocol/go-sdkGitHub Actions
Documentation
devaluelock entry to v5.9.2Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
github.comTo allow these domains, add them to the
network.allowedlist in your workflow frontmatter:See Network Configuration for more information.