From 959f8eabf4a98d96d1c097c28d832323ff21da7d Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 10 Sep 2026 12:34:06 +0000 Subject: [PATCH] chore: remove stale Dependabot references from workflow comments Dependabot config was already removed; update CI and release workflow comments so they no longer mention .github/dependabot.yml. Co-authored-by: dojce1048 --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0e1b65d..918404e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,7 +15,7 @@ jobs: name: typecheck · lint · unit · build runs-on: ubuntu-latest steps: - # SHA-pinned actions (tag-hijack defense); kept current by Dependabot. + # SHA-pinned actions (tag-hijack defense). - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 06e262c..e7cfaec 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,8 +19,7 @@ jobs: runs-on: ubuntu-latest steps: # Actions are pinned to a commit SHA, not a moving tag: a tag like @v6 can be repointed at malicious - # code (a tag-hijack supply-chain attack); a SHA cannot. Dependabot (.github/dependabot.yml) keeps the - # pins current. + # code (a tag-hijack supply-chain attack); a SHA cannot. - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # full history so release-it can create the tag + generate release notes