Repository navigation
build(deps): bump goreleaser/goreleaser-action from 7.2.3 to 7.3.0 - #246
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 7.2.3 to 7.3.0. - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](goreleaser/goreleaser-action@f06c13b...a4f02ab) --- updated-dependencies: - dependency-name: goreleaser/goreleaser-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
P3
|
Codex review: needs maintainer review before merge. What this changesThis PR updates the SHA-pinned GoReleaser GitHub Action from v7.2.3 to v7.3.0. Example: Ubuntu CI builds snapshot artifacts using GoReleaser v2.18.2.
Review scores
ProductKind: Maintenance · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review Keep open: this focused dependency update is absent from current main, preserves the snapshot-build configuration, and introduces no identified defect. Priority: P3 Before mergeNone. FindingsNone. Agent review detailsHow this fits togetherThe CI workflow passes a pinned GoReleaser version and snapshot arguments to a third-party action, which installs the tool and builds unpublished release artifacts. flowchart LR
A[Pull request] --> B[Ubuntu CI job]
B --> C[Pinned GoReleaser action]
C --> D[GoReleaser v2.18.2]
D --> E[Snapshot artifacts]
Technical reviewBest possible solution: Land the focused SHA-pinned action update through the normal repository review path. Do we have a high-confidence way to reproduce the issue? This is dependency maintenance rather than a reported runtime bug; the introduced SHA update and successful snapshot step are independently verified. Is this the best way to solve the issue? Updating the existing pinned action is appropriately scoped and retains the reproducibility and snapshot behavior established by prior maintenance. AGENTS.md: found but not applied because it conflicted with ClawSweeper's review contract. Codex review notes: model internal, reasoning medium; reviewed against 0b0b979b3cd6. Provenance checked
TestingProof path: none. SecurityNone. EvidenceWhat I checked:
LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment Reviewed October 15, 2026, 2:56 PM ET / 18:56 UTC. |
Consolidate Dependabot #246, #247, #248, #249, #250, and #251. Update CrawlKit to 0.17.0, ANSI helpers to 0.11.9, transitive modules, and the Node setup, GoReleaser, app-token, and secret-scanning actions. Retain the Go 1.27.2 minimum. Thanks @dependabot. Expose an explicit release dry run, forwarding the typed input to the shared workflow so the current version can be built, signed, and verified without publication. Document the command. Validation: full make check passed on AWS, including 85.1% coverage, govulncheck with no vulnerabilities, docs, release-script tests, and six-platform snapshot builds. actionlint and independent Codex autoreview through P3 passed. Exact-head CI was required before merge.
|
Included goreleaser/goreleaser-action 7.3.0 in #252, now merged. The consolidated update passed the full make check gate, including govulncheck, 85.1% coverage, six-platform snapshot builds, and exact-head Linux/macOS/Windows/Docker CI. Closing this superseded dependency PR. Thanks! |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
1 participant
Bumps goreleaser/goreleaser-action from 7.2.3 to 7.3.0.
Release notes
Sourced from goreleaser/goreleaser-action's releases.
Commits
a4f02abchore: update generated filese27eb77chore(deps): bump the npm group with 2 updates (#580)f5b4e31chore(deps): bump undici from 6.28.0 to 6.29.0 (#579)2d42c26ci(deps): bump codecov/codecov-action (#581)73cd4fffeat: reuse the goreleaser binary from the runner tool cache (#577)97a9607chore: update generated files689e48fchore(deps): bump js-yaml from 5.2.3 to 5.4.1 in the npm group (#578)7e6b514chore: update generated files4ec1183chore(deps): bump js-yaml from 5.2.2 to 5.2.3 (#573)59060fdchore: update generated filesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)