deps: four action majors + denoland/deno 2.9.5 #23
thisilike
Loading…
Reference in a new issue
No description provided.
Delete branch "deps/actions-majors-and-deno-2.9.5"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Resolves the six weekly dep-check issues in one pass.
Actions (all major bumps — breaking changes read, none apply)
pull_request_target/workflow_runDOCKER_BUILD_NO_SUMMARY/DOCKER_BUILD_EXPORT_RETENTION_DAYSenv vars, legacy export-build toolcontext/file/push/tags/build-args/cache-from/cache-to) survives in v7SHAs resolved from the code.forgejo.org mirrors — the scheme was validated by reproducing the existing pin (
v6mirror tag = the currently pinned SHA). Tag comments now name the exact release the SHA points at.Deno image 2.5.6 → 2.9.5 (build stage +
bin-COPY)Same major line, but 2.9.5 ships TypeScript 6.0.3 (vs 5.9.2), so the whole CI surface was run against this checkout with a real 2.9.5 binary:
deno install --frozen— lockfile survives, no re-resolutiondeno fmt --check— clean (the HTML/CSS/SVG exclusion in deno.json already anticipated the 2.5.6/2.9.x formatter divergence)deno lint— cleandeno task check— clean under TS 6.0.3deno task build— clean (Vite 7 pin unaffected)deno task test— same result as 2.5.6: 299 pass, the same 4 Windows-only failures (git-patch/unix-path tests) on both versions, so no 2.9.5 regressiontools/dep-check --dry-run— parses every new pin, reports all six currentDigests are the multi-arch index digests from Docker Hub; the method reproduces the existing 2.5.6 pins exactly. CI's toolchain follows automatically —
.forgejo/deno.shreads the image from the DockerfileFROMline.What CI on this PR actually covers
Worth stating precisely rather than leaving to be assumed.
verifyrunsactions/checkoutanddeno task ci, so of the four action bumps this PR proves exactly one on the real (Linux) toolchain, plus the whole Deno 2.9.5 surface.The other three — login-action, setup-buildx-action, build-push-action — live in
build, gated ongithub.event_name == 'push' && github.ref == 'refs/heads/main'. They first execute on the merge commit, in the job that ends in the SSH deploy. The blast radius is bounded: all three run before the deploy steps, so a failure there aborts the job and production keeps serving the image it already has. It is a rollback of a not-yet-deployed build, not a broken deploy — but the first real execution is post-merge, and the local verification above is what stands in for it.Follow-ups from review
docs/dependencies.mdtaught@<sha> # v6and its re-pinning recipe greppedv6, which nothing in the tree would match after this merge. It now teaches the exact release and says what that does and does not buy — the check sees a patch bump either way (comparetreats a missing component as zero); what the exact release adds is that the comment still identifies which commit is pinned once the major tag moves.deno.jsonfmt-exclusion comment explained itself in terms of the 2.5.6 pin this PR removes. Restated as the general cross-version instability, with the note that the exclusion is still load-bearing on the version pinned today rather than inherited.opsdeck rig-base: registry answered HTTP 401) is unrelated to these bumps — a locally built dev-rig image that dep-check resolves against Docker Hub. Split out as #25.Closes #13
Closes #14
Closes #15
Closes #16
Closes #17
Closes #18
🤖 Generated with Claude Code
Approved. Every claim in the description was re-derived independently rather than taken on trust, and all of them hold.
What was verified, and how
Action SHAs. All four resolve to the tags the comments name on
code.forgejo.org— the host the runner actually resolvesuses:against:3d3c42e5dbcb8138bb05f3f553b7df96checkout v7.0.1 is the same SHA on github.com, so the mirror is a true mirror and not a rebuild. The old pins reproduce as well (login-action v3 =
c94ce9fb), which is the validation the description claims. All four are the newest tag on the mirror, andtools/dep-check --dry-runagrees: six pins, all up to date.Image digests.
b429777cand0d1262faare the multi-arch index digests Docker Hub reports for2.9.5andbin-2.9.5; 2.9.5 is the newest tag on that line.Breaking changes. The release notes match the table item for item. checkout v7 is PR #2454, "block checking out fork pr for pull_request_target and workflow_run" — neither trigger appears in either workflow, and both already gate to same-repository pull requests. The three Docker actions are node24 + ESM, plus the removed envs and deprecated inputs. The node24 argument checks out from the other side too: the previously pinned checkout SHA already declares
using: node24, so the runtime is proven rather than assumed. Every input used here still exists in the v7.3.0 and v4.6.0action.yml, andDOCKER_BUILD_NO_SUMMARY/DOCKER_BUILD_EXPORT_RETENTION_DAYSappear nowhere in the tree.Toolchain. Re-run against this checkout on 2.9.4 (same TypeScript 6.0.3 as 2.9.5):
deno install --frozenclean withdeno.lockuntouched,fmt --checkclean,lintclean,task checkclean, 303 passed / 0 failed — which is the described 299 plus exactly the 4 that fail only on Windows per #20.Then
docker/Dockerfilewas built end to end. The build stage runsinstall --frozen,task buildandtask checkunder the real 2.9.5 image and passes, and thebin-2.9.5binary executes on the pinnedbookworm-slimdigest. That last one is the check worth naming: abin-bump can raise the glibc floor and break only at runtime, in the stage the type checker never sees. It does not here — the runtime image reportsdeno 2.9.5.The fmt exclusion. Keeping it is correct, and it is still load-bearing rather than inherited: remove the exclude and 2.9.4 rewrites
favicon.svg. Under 2.5.6 all three files differ,index.htmlon precisely the<!doctype>/<!DOCTYPE>split the comment describes.Bookkeeping. #13/#16/#17/#18 are the action issues and #14/#15 the image issues; the commits close the right ones.
Nits — none blocking
docs/dependencies.mdwas not moved with the convention. This PR deliberately changes tag comments from the floating major to the exact release, which is the better scheme. But the document that defines the convention still teaches@<sha> # v6(lines 125, 146, 172), and its re-pinning recipe grepsselect(.name == "v6")(line 179). After this merges the repository contains zero pins written that way, so the doc describes a style nothing uses."The verify job on this PR is the remaining proof" claims more than it delivers.
verifyruns checkout anddeno task ci. login-action, setup-buildx-action and build-push-action all live inbuild, which is gated ongithub.event_name == 'push' && github.ref == 'refs/heads/main'— so three of the four action bumps first execute on the merge commit, inside the job that ends in the SSH deploy. The blast radius is small and worth stating rather than glossing: a failure there aborts before the deploy step, so production keeps running the old image. Better to say the coverage stops at checkout than to let the sentence imply otherwise.The
deno.jsoncomment has become archaeology. It now explains the exclusion in terms of a pin the repository no longer has, so it needs rewriting at every bump — and the commit message argues the opposite, that the instability "is between versions generally, not specific to 2.5.6". Stating the general instability, without a version pair, would match the reasoning and stop the comment from rotting.Unrelated to this PR, noted because it is the one non-green line in the dry run:
opsdeck rig-base: registry answered HTTP 401.docker/dev-rig/DockerfilebuildsFROM opsdeck:rig-base, a locally built image that dep-check tries to resolve against Docker Hub. It arrived with #10 and belongs in its own issue.