chore(ci): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 - #114
Closed
dependabot[bot] wants to merge 1 commit into
Closed
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 4.1.1 to 4.2.2. - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](actions/attest-build-provenance@0f67c3f...4d10147) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
tomtom215
pushed a commit
that referenced
this pull request
Aug 20, 2026
Dependabot (#110, #111, #112, #113, #114), applied on top of the 0.16.1 work rather than merged, because two of the five were still based on pre-0.16.0 main and #112's lockfile was generated against a different base. - duckdb / libduckdb-sys 1.10504.0 -> 1.10505.0 (DuckDB 1.5.5). Upstream traded reqwest for ureq, dropping tokio, hyper, quinn, rust_decimal and rkyv from the build graph. Validated by the full bundled-test suite against a DuckDB 1.5.5 built from source: 705 tests, 0 failures. scripts/check-abi-table.py confirms against upstream headers that 1.5.5 is 546 slots, which src/abi.rs already covers, so the ABI guard needed no change. - actions/checkout 7.0.0 -> 7.0.1, Swatinem/rust-cache 2.9.1 -> 2.9.2, actions/attest-build-provenance 4.1.1 -> 4.2.2, across all six workflows and in the workflow the scaffold generates -- which Dependabot does not see, so generated projects would have kept shipping the old pins. Dependabot could not see one thing the bump invalidated. ci.yml downloads a prebuilt libduckdb by URL, with a comment reading "Keep the version in sync with the duckdb / libduckdb-sys dependency (1.10504.x == DuckDB v1.5.4)". Bumping the dependency does not bump a curl URL, so merging #112 alone would have left the only job that exercises the DuckDB 1.5.x FFI wrappers against a real runtime testing a different DuckDB than the crate is built for. Now v1.5.5, verified to exist before repointing CI at it. A semver validator that accepted invalid versions. validate_semver cites semver.org and enforces the leading-zero rule on MAJOR.MINOR.PATCH, but never applied rule 9 to pre-release identifiers, so 1.0.0-01, 1.0.0-alpha.01 and 1.0.0-0.03.7 were all accepted. The existing tests came from the spec's valid examples, so nothing covered the invalid side. Rule 10 deliberately does not restrict build metadata, and that asymmetry now has its own test so 1.0.0-alpha+001 cannot regress. Lockfile drift was invisible to CI. No job anywhere passed --locked, so cargo silently refreshed a stale committed lock in place and nothing failed. That is why examples/hello-ext/Cargo.lock sat on quack-rs 0.15.0 across two releases, and why 0.16.1's correction to 0.16.0 went stale again the moment the version was bumped. Both locks are current and cargo metadata --locked now runs for each in CI and in check-matrix.sh. The book's code was never compiled, and one chapter's main example did not build. docs.yml ran only mdbook build, which never invokes the compiler. Turning the check on found that scaffold.md's primary usage example omits three fields 0.16.0 added to ScaffoldConfig, so anyone following that chapter hit E0063 -- the same defect 0.16.1 fixed in publishing.md, in a second copy the audit missed. Enabling the check needed three fixes of its own: mdbook forwards only -L to rustdoc and -L cannot put a crate in scope in any edition, so scripts/mdbook-test.sh injects --extern via a rustdoc shim; rustdoc defaults to edition 2015, where --extern does not populate the extern prelude, so book.toml now pins edition 2021; and the build needs duckdb-1-5-3, without which the gated API the book documents reads as "no method named ...". 89 blocks now compile on every docs run, 111 progressive fragments and pseudo-code blocks are marked rust,ignore, and 10 diagrams that were fenced bare are now text -- mdbook treats an unannotated fence as Rust, so those were being compiled too. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SQNm9jYKVzHoqhKNMkvvYq
This was referenced Aug 20, 2026
Owner
|
Folded into
Applied alongside #110 and #113 in one commit rather than merged, since this branch was still based on pre-0.16.0 A repo-wide check confirms no stale SHA remains for any of the three actions, and every third-party action across all six workflows is SHA-pinned, per the policy in Generated by Claude Code |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/github_actions/actions/attest-build-provenance-4.2.2
branch
August 20, 2026 15:07
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/attest-build-provenance from 4.1.1 to 4.2.2.
Release notes
Sourced from actions/attest-build-provenance's releases.
Commits
4d10147Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (#862)e3fe62eBump the actions-minor group with 2 updates (#860)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)