Update all repos to peter-evans/[email protected]

[jlebon]

We're hitting a known issue that has been fixed in v6.0.1.

All instances where we use this action: https://github.com/search?q=org%3Acoreos+%22uses%3A+peter-evans%2Fcreate-pull-request%22&type=code

None of the breaking changes should affect us, so we should be good to just bump to v6.0.2.

[travier]

Ideally, we should setup depandabot as well to get those updates in automatically. Example in https://github.com/travier/fedora-kinoite/blob/main/.github/dependabot.yml

[travier]

We can likely use https://github.com/coreos/repo-templates/tree/main/dependabot to do that.

Edit: Hum, https://github.com/coreos/repo-templates/blob/main/dependabot/dependabot.yml needs tweaking.

[jlebon]

Ideally, we should setup depandabot as well to get those updates in automatically. Example in travier/fedora-kinoite@main/.github/dependabot.yml

Mayyybe. If it's bumping across major versions, you can't just merge as is. You have to check what breaking changes happened and verify that it doesn't apply to you. And of course for the workflows we're talking about here, it's not really tested by CI.

If it's bumping within major versions, then we don't need Dependabot for that; we just have to pin to a major version and not be more specific (e.g. peter-evans/create-pull-request@v6).

[aaradhak]

So do we just bump to peter-evans/[email protected] without setting up the dependabot ?

Ideally, we should setup depandabot as well to get those updates in automatically. Example in travier/fedora-kinoite@main/.github/dependabot.yml

Mayyybe. If it's bumping across major versions, you can't just merge as is. You have to check what breaking changes happened and verify that it doesn't apply to you. And of course for the workflows we're talking about here, it's not really tested by CI.

If it's bumping within major versions, then we don't need Dependabot for that; we just have to pin to a major version and not be more specific (e.g. peter-evans/create-pull-request@v6).

[jlebon]

So do we just bump to peter-evans/[email protected] without setting up the dependabot ?

How about for now bumping to peter-evans/create-pull-request@v6? That'll give us minor version tracking and we could down the line set up Dependabot for major version bumps if we feel it's worth it.

[jlebon]

@aaradhak All of those PRs are bumping the GHA to v6.0.2, but in #1699 (comment), my suggestion was to bump to v6 instead. Was that on purpose?

[aaradhak]

@jlebon I was trying to look into the difference between v6.0.0 and v6.0.2. I have updated to v6.0.0 now.

[jlebon]

This is done now. Thanks @aaradhak!