build(deps): bump peter-evans/create-issue-from-file from 5.0.1 to 6.0.0#2658
Conversation
Bumps [peter-evans/create-issue-from-file](https://github.com/peter-evans/create-issue-from-file) from 5.0.1 to 6.0.0. - [Release notes](https://github.com/peter-evans/create-issue-from-file/releases) - [Commits](peter-evans/create-issue-from-file@e8ef132...fca9117) --- updated-dependencies: - dependency-name: peter-evans/create-issue-from-file dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
While the version bump itself is straightforward, the upgrade to v6.0.0 introduces two breaking changes that require manual configuration updates: the need for explicit issues: write permissions and a new default failure behavior when input files are empty.
Furthermore, the existing workflow logic for detecting job failures via custom environment variables is currently non-functional, meaning the issue creation step would be skipped even if permissions were correct. These issues must be addressed to ensure the scheduled reports continue to function after the upgrade.
Test suggestions
- Verify issue creation for 'Broken link report' succeeds on workflow failure with version 6.0.0.
- Verify issue creation for 'Missing supported tools report' succeeds on workflow failure with version 6.0.0.
- Verify issue creation for 'Missing security tools report' succeeds on workflow failure with version 6.0.0.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify issue creation for 'Broken link report' succeeds on workflow failure with version 6.0.0.
2. Verify issue creation for 'Missing supported tools report' succeeds on workflow failure with version 6.0.0.
3. Verify issue creation for 'Missing security tools report' succeeds on workflow failure with version 6.0.0.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| - name: Create issue | ||
| if: env.lychee_exit_code != 0 | ||
| uses: peter-evans/create-issue-from-file@e8ef132d6df98ed982188e460ebb3b5d4ef3a9cd # v5 | ||
| uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6.0.0 |
There was a problem hiding this comment.
🔴 HIGH RISK
Upgrading to v6.0.0 requires the issues: write permission for the GITHUB_TOKEN. Furthermore, the if condition on line 24 is broken as env.lychee_exit_code is undefined and the step will be skipped on job failure. Try running the following prompt in your coding agent: > Add permissions: issues: write to the workflow and update the check-broken-links job to use continue-on-error: true with a corrected if: failure() condition for issue creation.
|
|
||
| - name: Create issue | ||
| uses: peter-evans/create-issue-from-file@e8ef132d6df98ed982188e460ebb3b5d4ef3a9cd # v5 | ||
| uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6.0.0 |
There was a problem hiding this comment.
🟡 MEDIUM RISK
Starting in v6.0.0, this action fails if the file at content-filepath is empty. If the python script fails without output, this step will crash the workflow. Try running the following prompt in your coding agent: > Ensure the create-issue-from-file step in the check-supported-tools and check-security-tools jobs only runs when the output file is not empty.
Bumps peter-evans/create-issue-from-file from 5.0.1 to 6.0.0.
Release notes
Sourced from peter-evans/create-issue-from-file's releases.
... (truncated)
Commits
fca9117v6 (#2082)b6ec9cbBump@types/nodefrom 18.19.124 to 18.19.127 (#2073)c30fbe4Bump@vercel/nccfrom 0.38.3 to 0.38.4 (#2072)6c3e77cBump@types/nodefrom 18.19.123 to 18.19.124 (#2065)cdb4e84Bump actions/setup-node from 4 to 5 (#2062)b1e467eBump@types/nodefrom 18.19.121 to 18.19.123 (#2057)b7a1ca8Bump actions/checkout from 4 to 5 (#2052)376c7d8Bump eslint-plugin-prettier from 5.5.3 to 5.5.4 (#2047)433a878Bump actions/download-artifact from 4 to 5 (#2042)a56a9d1Bump@types/nodefrom 18.19.120 to 18.19.121 (#2037)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)