From 13fbc589814bc552d3c8f257e9b5c7338dc1501b Mon Sep 17 00:00:00 2001 From: Mahmoud Elmorabea Date: Mon, 31 Aug 2026 18:18:35 +0400 Subject: [PATCH] chore: pin semantic-release plugin versions @semantic-release/github and @semantic-release/exec were the last unpinned entries in extra_plugins, so each release resolved whatever npm called latest at that moment. Pin them to the versions the workflow already resolves today. Co-Authored-By: Claude Opus 5 --- .github/workflows/deploy-sdk.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/deploy-sdk.yml b/.github/workflows/deploy-sdk.yml index 44324679..ca580f88 100644 --- a/.github/workflows/deploy-sdk.yml +++ b/.github/workflows/deploy-sdk.yml @@ -41,14 +41,18 @@ jobs: uses: cycjimmy/semantic-release-action@0a51e81a6baff2acad3ee88f4121c589c73d0f0e # v4.2.0 id: semantic-release with: - # Both pinned deliberately. The conventionalcommits 10.x line renders through - # @conventional-changelog/template, which needs conventional-changelog-writer@9; + # Every version here is pinned deliberately. The conventionalcommits 10.x line renders + # through @conventional-changelog/template, which needs conventional-changelog-writer@9; # every released semantic-release resolves writer@8, so 10.x cannot render here. + # + # Dependabot cannot see these versions: the `github-actions` ecosystem only resolves + # `uses:` refs, and no ecosystem parses `extra_plugins`. An unpinned entry silently + # floats to whatever is `latest` at release time, so bump these by hand. semantic_version: 25.0.9 extra_plugins: | conventional-changelog-conventionalcommits@9.3.1 - @semantic-release/github - @semantic-release/exec + @semantic-release/github@12.0.9 + @semantic-release/exec@7.1.0 env: # Needs to push git commits to repo. Needs write access. GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}