Repository navigation
chore(deps): update launchdarkly/gh-actions requirement to release-secrets-v1.2.0 - #718
Merged
nieblara merged 2 commits intoOct 13, 2026
Conversation
…crets-v1.2.0 Updates the requirements on [launchdarkly/gh-actions](https://github.com/launchdarkly/gh-actions) to permit the latest version. - [Release notes](https://github.com/launchdarkly/gh-actions/releases) - [Commits](https://github.com/launchdarkly/gh-actions/commits/release-secrets-v1.2.0) --- updated-dependencies: - dependency-name: launchdarkly/gh-actions dependency-version: 1.2.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
cursor Bot
pushed a commit
that referenced
this pull request
Oct 6, 2026
- classify.sh: when workflows pin an action at several old refs, record each ref that the PR replaces. The old version is the lowest of them. Before, #718 compared release-secrets v1.2.0 with itself, and #717 compared only setup-go v5 with v6. - actions_analysis.py: compare each replaced ref with the new ref. An output or input counts as removed only if an old action.yml declared it. release-please-action declares no outputs and sets them at run time, which gave a false block on #722. - actions-coverage.sh: read fields with the unit separator. Tab is IFS whitespace, so empty fields collapsed and shifted the runtime into the wrong field (#717, #721). Show a missing default as "none". Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>
cursor Bot
pushed a commit
that referenced
this pull request
Oct 6, 2026
New fixtures: #717 safe-to-merge (setup-go from v4 and v5), #718 compares release-secrets v1.0.1 with v1.2.0, #721 needs-human with the python-version question, #722 needs-human (not block), and #779 block with the undisclosed updates and no esbuild question. The #831 fixture expects the new wording. The impact-review copies drop notes about the old verifier bugs. replay.sh supports pr_meta, decisions_exclude, and updates expectations. run.sh adds 16 unit tests with stub tools: the findings subset rule, golangci-lint lock contention, npm warn lines, install scripts on base, pr-disclosure, pr-state wording, classify with mixed refs, and actions-coverage with a stub gh. Co-authored-by: Ramon Niebla <nieblara@users.noreply.github.com>
2 of 3 tasks
Dependency verification: SAFE TO MERGERisk tier medium (release-tooling) · ecosystems: github-actions · head Every required check ran and passed. No decision is necessary. Updates
What the verifier checked
Already failing on
|
| Check | Kind | Base | PR | Outcome |
|---|---|---|---|---|
| manual-publish.yml passes the same release-secrets inputs as the release job | guard | pass | pass | holds on both |
Impact review
launchdarkly/gh-actions release-secrets moves from v1.0.1 to v1.2.0 in manual-publish.yml. v1.0.2 pins ssm-getparameters to a SHA, v1.1.0 adds optional S3 file downloads, and v1.2.0 uses configure-aws-credentials v4. ldcli passes only aws_assume_role and ssm_parameter_pairs, which keep their meaning. release-please.yml on main already uses v1.2.0 with the same inputs, and that step passed in release run 35993978650 on 2026-09-24.
- launchdarkly/gh-actions/actions/release-secrets release-secrets-v1.0.1..release-secrets-v1.2.0: 1.0.2: pin aws/ssm-getparameters-action to a SHA. 1.1.0: optional download of files from S3. 1.2.0: configure-aws-credentials v4. (source)
- Used in:
.github/workflows/manual-publish.yml,.github/workflows/release-please.yml - Upstream behavior changes that reach ldcli: no
- Note: The inputs that ldcli passes are unchanged, and the S3 download is opt-in. The configure-aws-credentials v4 change is already in use: the release-ldcli job ran the v1.2.0 'Get Docker token' step with the same inputs and passed (guard compares the inputs). (https://github.com/launchdarkly/ldcli/actions/runs/35993978650, generated/release-secrets-same-inputs-as-release.sh)
- Note: PR CI does not run manual-publish.yml. The guard shows that it passes the same release-secrets inputs as the release job, which ran v1.2.0 successfully. (state/checks/actions-coverage)
Check details
pr-state
- Branch is 51 commit(s) behind
main. The checks ran on the PR merged into the currentmain.
ci-status
- CI results are for the PR head
4ee96f2as pushed, which may be behind the base branch.
upstream-changes
launchdarkly/gh-actions/actions/release-secretsrelease-secrets-v1.0.1 → release-secrets-v1.2.0: launchdarkly/gh-actions, 19 commits, 19 files, notes: release notes, full range
actionlint
.github/workflows/go.yml:20:13: the runner of "actions/setup-go@v4" action is too old to run on GitHub Actions. update the action's version to fix this issue [action]
.github/workflows/go.yml:29:13: the runner of "actions/setup-python@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue [action]
.github/workflows/release-please.yml:60:14: label "ubuntu-22.04-8core-32gb" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-2019", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "ubuntu-20.04", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file [runner-label]
actions-coverage
| Action | Change | Used in | Runs on PR CI? | Upstream action.yml |
|---|---|---|---|---|
launchdarkly/gh-actions/actions/release-secrets |
release-secrets-v1.0.1 → release-secrets-v1.2.0 | .github/workflows/manual-publish.yml, .github/workflows/release-please.yml | no | inputs used: aws_assume_role, ssm_parameter_pairs; outputs read: none; runtime composite → composite |
generated: release-secrets-same-inputs-as-release
manual-publish.yml and the release-ldcli job in release-please.yml pass the same release-secrets inputs (aws_assume_role and the Docker Hub SSM pairs).
Generated by scripts/dependency-pr/verify.sh (profile full) at 2026-10-06T22:07:41Z. The verifier does not approve or merge.
…tions-release-secrets-v1.2.0
nieblara
approved these changes
Oct 13, 2026
nieblara
deleted the
dependabot/github_actions/launchdarkly/gh-actions-release-secrets-v1.2.0
branch
October 13, 2026 06:22
cursor Bot
pushed a commit
that referenced
this pull request
Oct 20, 2026
A base lockfile entry without a license field became "unknown", so the #635 replay asked to accept a change from unknown to MIT. A missing base license now gives no license to compare, as before. The #718 fixture now expects the composite question: v1.2.0 moves the nested configure-aws-credentials from v1-node16 to v4 in release-only workflows. Co-authored-by: rniebla <rniebla@launchdarkly.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the requirements on launchdarkly/gh-actions to permit the latest version.
Release notes
Sourced from launchdarkly/gh-actions's releases.
Commits
You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Overview
Bumps the
release-secretsstep in the manual publish workflow fromrelease-secrets-v1.0.1torelease-secrets-v1.2.0, still used to load Docker Hub credentials from SSM before image publish.Upstream v1.2.0 switches the action to configure-aws-credentials v4; behavior for this job (assume role + SSM parameter pairs) is unchanged from the caller’s perspective.
Reviewed by Cursor Bugbot for commit 02a079d. Bugbot is set up for automated code reviews on this repo. Configure here.